Weaknesses of type CWE-284

7,147 results

Controle de acesso inadequado a recursos

A aplicação falha em validar ou impõe regras insuficientes para determinar quem pode acessar um recurso (arquivo, API, dados, funcionalidade). Um usuário não autorizado consegue contornar essas restrições e acessar o que não deveria, seja por falta de autenticação, autorização fraca ou lógica de controle de acesso bugada.

Example

Um sistema de gestão de RH permite que qualquer funcionário logado acesse `/api/salarios/{id}` substituindo o ID na URL. Sem verificar se o usuário é gestor ou RH, a API retorna dados salariais de qualquer pessoa da empresa. Um dev junior consegue ver quanto ganha o CTO.

How to mitigate

Implemente verificação explícita de permissões antes de qualquer acesso: confirme autenticação (quem é), autorização (o que pode fazer) e aplique o princípio do menor privilégio. Use listas de controle de acesso (ACL), roles bem definidos e sempre valide no backend, nunca confie em dados do cliente.

CVE-2026-70856HIGHVulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Migration). Supported versions that are affected are 17EPSS 0.3%CVE-2024-32124MEDIUMAn improper access control vulnerability [CWE-284] in FortiIsolator version 2.4.4, version 2.4.3, 2.3 all versions logging component may allEPSS 0.3%CVE-2025-8128MEDIUMzhousg letao product.js unrestricted uploadEPSS 0.3%CVE-2026-51610MEDIUMIncorrect access control in the RebootSystem function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to arbitrarily fEPSS 0.3%CVE-2020-1666MEDIUMJunos OS Evolved: 'console log-out-on-disconnect' fails to terminate session on console cable disconnectionEPSS 0.3%CVE-2026-87229HIGHVulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security). The supported version that is EPSS 0.3%CVE-2026-82486LOWSiteServer SSCMS Agent Installation Workflow access controlEPSS 0.3%CVE-2024-40547MEDIUMPublicCMS v4.0.202302.e was discovered to contain an arbitrary file content replacement vulnerability via the component /admin/cmsTemplate/rEPSS 0.3%CVE-2025-55797MEDIUMAn improper access control vulnerability in FormCms v0.5.4 in the /api/schemas/history/[schemaId] endpoint allows unauthenticated attackers EPSS 0.3%CVE-2025-10071MEDIUMPortabilis i-Educar cancelar-enturmacao-em-lote access controlEPSS 0.3%CVE-2024-5470LOWImproper Access Control in GitLabEPSS 0.3%CVE-2026-61205HIGHVulnerability in the PeopleSoft Enterprise SCM Purchasing product of Oracle PeopleSoft (component: Purchasing). The supported version thatEPSS 0.3%CVE-2025-10070MEDIUMPortabilis i-Educar enturmacao-em-lote access controlEPSS 0.3%CVE-2026-73925HIGHVulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative Web Server). Supported versions that are affected aEPSS 0.3%CVE-2026-69414HIGHMicrosoft Defender Elevation of Privilege VulnerabilityEPSS 0.3%CVE-2025-11078MEDIUMitsourcecode Open Source Job Portal controller.php unrestricted uploadEPSS 0.3%CVE-2023-1453MEDIUMWatchdog Anti-Virus IoControlCode wsdk-driver.sys 0x80002008 access controlEPSS 0.3%CVE-2024-24487MEDIUMAn issue discovered in silex technology DS-600 Firmware v.1.4.1 allows a remote attacker to cause a denial of service via crafted UDP packetEPSS 0.3%CVE-2025-50861MEDIUMThe Lotus Cars Android app (com.lotus.carsdomestic.intl) 1.2.8 contains an exported component, PushDeepLinkActivity, which is accessible witEPSS 0.3%CVE-2025-11426MEDIUMprojectworlds Advanced Library Management System edit_book.php unrestricted uploadEPSS 0.3%