Weaknesses of type CWE-284

7,165 results

Controle de acesso inadequado a recursos

A aplicação falha em validar ou impõe regras insuficientes para determinar quem pode acessar um recurso (arquivo, API, dados, funcionalidade). Um usuário não autorizado consegue contornar essas restrições e acessar o que não deveria, seja por falta de autenticação, autorização fraca ou lógica de controle de acesso bugada.

Example

Um sistema de gestão de RH permite que qualquer funcionário logado acesse `/api/salarios/{id}` substituindo o ID na URL. Sem verificar se o usuário é gestor ou RH, a API retorna dados salariais de qualquer pessoa da empresa. Um dev junior consegue ver quanto ganha o CTO.

How to mitigate

Implemente verificação explícita de permissões antes de qualquer acesso: confirme autenticação (quem é), autorização (o que pode fazer) e aplique o princípio do menor privilégio. Use listas de controle de acesso (ACL), roles bem definidos e sempre valide no backend, nunca confie em dados do cliente.

CVE-2026-83230HIGHVulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Siebel Management Console). Supported versions that areEPSS 0.3%CVE-2026-83172HIGHVulnerability in the Oracle Sales Online product of Oracle E-Business Suite (component: OSO Other). Supported versions that are affected arEPSS 0.3%CVE-2026-83309HIGHVulnerability in the Oracle BI Publisher product of Oracle Analytics (component: Web Server). Supported versions that are affected are 8.2.EPSS 0.3%CVE-2026-82993HIGHVulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Business Interlink). Supported versions thaEPSS 0.3%CVE-2017-14031—An Improper Access Control issue was discovered in Trihedral VTScada 11.3.03 and prior. A local, non-administrator user has privileges to reEPSS 0.3%CVE-2026-5230HIGHImproper Access Control in Mia Technologies' Pizzy LibraryEPSS 0.3%CVE-2026-85545HIGHThere is an Vulnerability in some HikCentral Access Control versions. Authenticated low-privilege users can invoke API interfaces that theirEPSS 0.3%CVE-2026-83217HIGHVulnerability in the Siebel CRM End User product of Oracle Siebel CRM (component: Open UI). Supported versions that are affected are 17.0-2EPSS 0.3%CVE-2026-13607MEDIUMFile Uploads Addon for WooCommerce <= 1.7.6 - Unauthenticated Direct File AccessEPSS 0.3%CVE-2026-70964HIGHVulnerability in the Oracle Hyperion Infrastructure Technology product of Oracle Hyperion (component: Installation and Configuration). TheEPSS 0.3%CVE-2026-60895MEDIUMVulnerability in the Oracle Unified Directory product of Oracle Fusion Middleware (component: OUD Core). Supported versions that are affectEPSS 0.3%CVE-2026-60744MEDIUMVulnerability in the Oracle Cost Management product of Oracle E-Business Suite (component: Internal Operations). Supported versions that arEPSS 0.3%CVE-2026-60666MEDIUMVulnerability in the PeopleSoft Enterprise HCM Human Resources product of Oracle PeopleSoft (component: Security). The supported version tEPSS 0.3%CVE-2026-60421HIGHVulnerability in the Oracle Unified Directory product of Oracle Fusion Middleware (component: OUD Core). Supported versions that are affectEPSS 0.3%CVE-2026-34314MEDIUMVulnerability in the Oracle Financial Services Analytical Applications Infrastructure product of Oracle Financial Services Applications (comEPSS 0.3%CVE-2026-70703HIGHVulnerability in the Oracle Agile Engineering Data Management product of Oracle Supply Chain (component: Engineering Communication InterfaceEPSS 0.3%CVE-2026-46993HIGHVulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Agent Next Gen). Supported veEPSS 0.3%CVE-2026-61134MEDIUMVulnerability in the Oracle Commerce Platform product of Oracle Commerce (component: Dynamo Application Framework). The supported version EPSS 0.3%CVE-2025-53092MEDIUMStrapi core vulnerable to sensitive data exposure via CORS misconfigurationEPSS 0.3%CVE-2026-73965MEDIUMVulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Cloud Gateway). Supported versions that are affected arEPSS 0.3%