Weaknesses of type CWE-284

7,967 results

Controle de acesso inadequado a recursos

A aplicação falha em validar ou impõe regras insuficientes para determinar quem pode acessar um recurso (arquivo, API, dados, funcionalidade). Um usuário não autorizado consegue contornar essas restrições e acessar o que não deveria, seja por falta de autenticação, autorização fraca ou lógica de controle de acesso bugada.

Example

Um sistema de gestão de RH permite que qualquer funcionário logado acesse `/api/salarios/{id}` substituindo o ID na URL. Sem verificar se o usuário é gestor ou RH, a API retorna dados salariais de qualquer pessoa da empresa. Um dev junior consegue ver quanto ganha o CTO.

How to mitigate

Implemente verificação explícita de permissões antes de qualquer acesso: confirme autenticação (quem é), autorização (o que pode fazer) e aplique o princípio do menor privilégio. Use listas de controle de acesso (ACL), roles bem definidos e sempre valide no backend, nunca confie em dados do cliente.

CVE-2021-1577CRITICALCisco Application Policy Infrastructure Controller Arbitrary File Read and Write VulnerabilityEPSS 1.3%CVE-2017-2664MEDIUMCloudForms Management Engine (cfme) before 5.7.3 and 5.8.x before 5.8.1 lacks RBAC controls on certain methods in the rails application portEPSS 1.3%CVE-2023-24320CRITICALAn access control issue in Axcora POS #0~gitf77ec09 allows unauthenticated attackers to execute arbitrary commands via unspecified vectors.EPSS 1.3%CVE-2023-4546LOWByzoro Smart S85F Management Platform licence.php access controlEPSS 1.3%CVE-2022-20859MEDIUMCisco Unified Communications Products Access Control VulnerabilityEPSS 1.3%CVE-2021-1243MEDIUMCisco IOS XR Software SNMP Management Plane Protection ACL Bypass VulnerabilityEPSS 1.3%CVE-2026-21667CRITICALA vulnerability allowing an authenticated domain user to perform remote code execution (RCE) on the Backup Server.EPSS 1.3%CVE-2025-30433CRITICALThis issue was addressed with improved access restrictions. This issue is fixed in iOS 18.4 and iPadOS 18.4, iPadOS 17.7.6, macOS Sequoia 15EPSS 1.3%CVE-2026-21666CRITICALA vulnerability allowing an authenticated domain user to perform remote code execution (RCE) on the Backup Server.EPSS 1.3%CVE-2018-0436—Cisco Webex Teams Information Disclosure and Modification VulnerabilityEPSS 1.3%CVE-2022-39405MEDIUMVulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Authentication Engine). The supported version thaEPSS 1.3%CVE-2020-10641—An unprotected logging route may allow an attacker to write endless log statements into the database without space limits or authentication.EPSS 1.3%CVE-2025-2553MEDIUMD-Link DIR-618/DIR-605L formVirtualServ access controlEPSS 1.3%CVE-2017-18101—Various administrative external system import resources in Atlassian JIRA Server (including JIRA Core) before version 7.6.5, from version 7.EPSS 1.3%CVE-2020-14504MEDIUMThe web interface of the 1734-AENTR communication module mishandles authentication for HTTP POST requests. A remote, unauthenticated attackeEPSS 1.3%CVE-2025-58751LOWVite middleware may serve files starting with the same name with the public directoryEPSS 1.3%CVE-2021-32517HIGHQSAN Storage Manager - Improper Access ControlEPSS 1.3%CVE-2016-9368—An issue was discovered in Eaton xComfort Ethernet Communication Interface (ECI) Versions 1.07 and prior. By accessing a specific uniform reEPSS 1.3%CVE-2023-32632HIGHA command execution vulnerability exists in the validate.so diag_ping_start functionality of Yifan YF325 v1.0_20221108. A specially crafted EPSS 1.3%CVE-2025-4468MEDIUMSourceCodester Online Student Clearance System edit-photo.php unrestricted uploadEPSS 1.3%