Weaknesses of type CWE-284

7,967 results

Controle de acesso inadequado a recursos

A aplicação falha em validar ou impõe regras insuficientes para determinar quem pode acessar um recurso (arquivo, API, dados, funcionalidade). Um usuário não autorizado consegue contornar essas restrições e acessar o que não deveria, seja por falta de autenticação, autorização fraca ou lógica de controle de acesso bugada.

Example

Um sistema de gestão de RH permite que qualquer funcionário logado acesse `/api/salarios/{id}` substituindo o ID na URL. Sem verificar se o usuário é gestor ou RH, a API retorna dados salariais de qualquer pessoa da empresa. Um dev junior consegue ver quanto ganha o CTO.

How to mitigate

Implemente verificação explícita de permissões antes de qualquer acesso: confirme autenticação (quem é), autorização (o que pode fazer) e aplique o princípio do menor privilégio. Use listas de controle de acesso (ACL), roles bem definidos e sempre valide no backend, nunca confie em dados do cliente.

CVE-2021-22853MEDIUMSoar Cloud System Co., Ltd. HR Portal - Broken Access ControlEPSS 1.0%CVE-2025-23048CRITICALApache HTTP Server: mod_ssl access control bypass with session resumptionEPSS 1.0%CVE-2022-20918HIGHA vulnerability in the Simple Network Management Protocol (SNMP) access controls for Cisco FirePOWER Software for Adaptive Security AppliancEPSS 1.0%CVE-2024-22187CRITICALA write-what-where vulnerability exists in the Programming Software Connection Remote Memory Diagnostics functionality of AutomationDirect PEPSS 1.0%CVE-2022-38184HIGHThere is an improper access control vulnerability in Portal for ArcGIS versions 10.8.1EPSS 1.0%CVE-2017-15891—Improper access control vulnerability in SYNO.Cal.EventBase in Synology Calendar before 2.0.1-0242 allows remote authenticated users to modiEPSS 1.0%CVE-2023-21968LOWVulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Libraries). Supported versionsEPSS 1.0%CVE-2020-8121—A bug in Nextcloud Server 14.0.4 could expose more data in reshared link shares than intended by the sharer.EPSS 1.0%CVE-2020-8182—Improper access control in Nextcloud Deck 0.8.0 allowed an attacker to reshare boards shared with them with more permissions than they had tEPSS 1.0%CVE-2024-20926MEDIUMVulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: ScriptiEPSS 1.0%CVE-2022-22183HIGHJunos OS Evolved: A remote attacker may cause a CPU Denial of Service by sending genuine traffic to a device on a specific IPv4 port.EPSS 1.0%CVE-2019-6193HIGHAn information disclosure vulnerability was reported in Lenovo XClarity Administrator (LXCA) versions prior to 2.6.6 that could allow unauthEPSS 1.0%CVE-2026-102132HIGHKiteworks Core Privilege Escalation through Improper Access ControlEPSS 1.0%CVE-2020-2504MEDIUMAbsolute path traversal vulnerability in QESEPSS 1.0%CVE-2024-38220CRITICALAzure Stack Hub Elevation of Privilege VulnerabilityEPSS 1.0%CVE-2019-11892HIGHImproper access control in the JSON-RPC interface of the Bosch Smart Home Controller (SHC)EPSS 1.0%CVE-2026-5311MEDIUMD-Link DNS-1550-04 file_center.cgi Webdav_Access_List access controlEPSS 1.0%CVE-2019-10138HIGHA flaw was discovered in the python-novajoin plugin, all versions up to, excluding 1.1.1, for Red Hat OpenStack Platform. The novajoin API lEPSS 1.0%CVE-2021-24845—Improved Include Page <= 1.2 - Contributor+ Arbitrary Posts/Pages AccessEPSS 1.0%CVE-2025-2548MEDIUMD-Link DIR-618/DIR-605L formSetDomainFilter access controlEPSS 1.0%