Weaknesses of type CWE-284

7,122 results

Controle de acesso inadequado a recursos

A aplicação falha em validar ou impõe regras insuficientes para determinar quem pode acessar um recurso (arquivo, API, dados, funcionalidade). Um usuário não autorizado consegue contornar essas restrições e acessar o que não deveria, seja por falta de autenticação, autorização fraca ou lógica de controle de acesso bugada.

Example

Um sistema de gestão de RH permite que qualquer funcionário logado acesse `/api/salarios/{id}` substituindo o ID na URL. Sem verificar se o usuário é gestor ou RH, a API retorna dados salariais de qualquer pessoa da empresa. Um dev junior consegue ver quanto ganha o CTO.

How to mitigate

Implemente verificação explícita de permissões antes de qualquer acesso: confirme autenticação (quem é), autorização (o que pode fazer) e aplique o princípio do menor privilégio. Use listas de controle de acesso (ACL), roles bem definidos e sempre valide no backend, nunca confie em dados do cliente.

CVE-2025-10608MEDIUMPortabilis i-Educar enrollment-history access controlEPSS 0.4%CVE-2026-60905CRITICALVulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server). Supported versions that are EPSS 0.4%CVE-2025-11436MEDIUMJhumanJ OpnForm answer unrestricted uploadEPSS 0.4%CVE-2025-45609HIGHIncorrect access control in the doFilter function of kob latest v1.0.0-SNAPSHOT allows attackers to access sensitive information via a craftEPSS 0.4%CVE-2026-28410MEDIUMThe Graph: Revocable vesting contracts allows early access to locked tokensEPSS 0.4%CVE-2026-21255HIGHWindows Hyper-V Security Feature Bypass VulnerabilityEPSS 0.4%CVE-2024-48010MEDIUMDell PowerProtect DD, versions prior to 8.1.0.0, 7.13.1.10, 7.10.1.40, and 7.7.5.50, contains an access control vulnerability. A remote highEPSS 0.4%CVE-2025-45424MEDIUMIncorrect access control in Xinference before v1.4.0 allows attackers to access the Web GUI without authentication.EPSS 0.4%CVE-2025-45614HIGHIncorrect access control in the component /api/user/manager of One v1.0 allows attackers to access sensitive information via a crafted payloEPSS 0.4%CVE-2025-45617HIGHIncorrect access control in the component /user/list of production_ssm v0.0.1-SNAPSHOT allows attackers to access sensitive information via EPSS 0.4%CVE-2026-7696MEDIUMAcrel Electrical EEMS Enterprise Power Operation and Maintenance Cloud Platform uploadH5Files unrestricted uploadEPSS 0.4%CVE-2026-21889LOWWeblate leaks information via screenshotsEPSS 0.4%CVE-2026-83067HIGHVulnerability in the Oracle JDeveloper product of Oracle Fusion Middleware (component: ADF Shared Components). Supported versions that are EPSS 0.4%CVE-2025-45613HIGHIncorrect access control in the component /user/list of Shiro-Action v0.6 allows attackers to access sensitive information via a crafted payEPSS 0.4%CVE-2026-72596HIGHGhost Foundation Ghost - Broken Access ControlEPSS 0.4%CVE-2026-16948HIGHSolace Extra < 1.6.1 - Subscriber+ Multiple Missing Authorization via Site-Wide Nonce ExposureEPSS 0.4%CVE-2025-47993HIGHMicrosoft PC Manager Elevation of Privilege VulnerabilityEPSS 0.4%CVE-2026-83314HIGHVulnerability in the Oracle BI Publisher product of Oracle Analytics (component: Web Service API). Supported versions that are affected areEPSS 0.4%CVE-2025-9406MEDIUMxuhuisheng lemon CmsArticleController.java uploadImage unrestricted uploadEPSS 0.4%CVE-2026-4586MEDIUMCodePhiliaX Chat2DB JDBC Driver Upload JdbcDriverController.java upload unrestricted uploadEPSS 0.4%