Weaknesses of type CWE-284

7,967 results

Controle de acesso inadequado a recursos

A aplicação falha em validar ou impõe regras insuficientes para determinar quem pode acessar um recurso (arquivo, API, dados, funcionalidade). Um usuário não autorizado consegue contornar essas restrições e acessar o que não deveria, seja por falta de autenticação, autorização fraca ou lógica de controle de acesso bugada.

Example

Um sistema de gestão de RH permite que qualquer funcionário logado acesse `/api/salarios/{id}` substituindo o ID na URL. Sem verificar se o usuário é gestor ou RH, a API retorna dados salariais de qualquer pessoa da empresa. Um dev junior consegue ver quanto ganha o CTO.

How to mitigate

Implemente verificação explícita de permissões antes de qualquer acesso: confirme autenticação (quem é), autorização (o que pode fazer) e aplique o princípio do menor privilégio. Use listas de controle de acesso (ACL), roles bem definidos e sempre valide no backend, nunca confie em dados do cliente.

CVE-2018-15631MEDIUMImproper access control in the Discuss App of Odoo Community 12.0 and earlier, and Odoo Enterprise 12.0 and earlier allows remote authenticaEPSS 1.4%CVE-2021-41194CRITICALImproper Access Control in jupyterhub-firstuseauthenticatorEPSS 1.4%CVE-2019-7476—A vulnerability in SonicWall Global Management System (GMS), allow a remote user to gain access to the appliance using existing SSH key. ThiEPSS 1.4%CVE-2026-39339CRITICALChurchCRM has an API Authentication BypassEPSS 1.4%CVE-2022-1025—All unpatched versions of Argo CD starting with v1.0.0 are vulnerable to an improper access control bug, allowing a malicious user to potentEPSS 1.3%CVE-2018-17953HIGHpam_access does not handle netmask matches correctlyEPSS 1.3%CVE-2020-3564MEDIUMCisco Adaptive Security Appliance Software and Firepower Threat Defense Software FTP Inspection Bypass VulnerabilityEPSS 1.3%CVE-2021-38457CRITICALAUVESY VersiondogEPSS 1.3%CVE-2018-19634—CA Service Desk Manager 14.1 and 17 contain a vulnerability that can allow a malicious actor to access survey information.EPSS 1.3%CVE-2023-44794—An issue in Dromara SaToken version 1.36.0 and before allows a remote attacker to escalate privileges via a crafted payload to the URL.EPSS 1.3%CVE-2022-25755—A vulnerability has been identified in SCALANCE X302-7 EEC (230V), SCALANCE X302-7 EEC (230V, coated), SCALANCE X302-7 EEC (24V), SCALANCE XEPSS 1.3%CVE-2025-63353CRITICALA vulnerability in FiberHome GPON ONU HG6145F1 RP4423 allows the device's factory default Wi-Fi password (WPA/WPA2 pre-shared key) to be preEPSS 1.3%CVE-2020-25629—A vulnerability was found in Moodle where users with "Log in as" capability in a course context (typically, course managers) may gain accessEPSS 1.3%CVE-2022-3065MEDIUMImproper Access Control in jgraph/drawioEPSS 1.3%CVE-2019-5617CRITICALC4G BLIS Improper Access ControlEPSS 1.3%CVE-2019-5644CRITICALC4G BLIS Improper Access ControlEPSS 1.3%CVE-2025-29804HIGHVisual Studio Elevation of Privilege VulnerabilityEPSS 1.3%CVE-2020-7547—A CWE-284: Improper Access Control vulnerability exists in EcoStruxureª and SmartStruxureª Power Monitoring and SCADA Software (see securityEPSS 1.3%CVE-2023-45744HIGHA data integrity vulnerability exists in the web interface /cgi-bin/upload_config.cgi functionality of Peplink Smart Reader v1.2.0 (in QEMU)EPSS 1.3%CVE-2020-7038HIGHAvaya Meetings Server Information Disclosure vulnerabilityEPSS 1.3%