Weaknesses of type CWE-284

7,967 results

Controle de acesso inadequado a recursos

A aplicação falha em validar ou impõe regras insuficientes para determinar quem pode acessar um recurso (arquivo, API, dados, funcionalidade). Um usuário não autorizado consegue contornar essas restrições e acessar o que não deveria, seja por falta de autenticação, autorização fraca ou lógica de controle de acesso bugada.

Example

Um sistema de gestão de RH permite que qualquer funcionário logado acesse `/api/salarios/{id}` substituindo o ID na URL. Sem verificar se o usuário é gestor ou RH, a API retorna dados salariais de qualquer pessoa da empresa. Um dev junior consegue ver quanto ganha o CTO.

How to mitigate

Implemente verificação explícita de permissões antes de qualquer acesso: confirme autenticação (quem é), autorização (o que pode fazer) e aplique o princípio do menor privilégio. Use listas de controle de acesso (ACL), roles bem definidos e sempre valide no backend, nunca confie em dados do cliente.

CVE-2023-2183MEDIUMGrafana is an open-source platform for monitoring and observability. The option to send a test alert is not available from the user panel EPSS 1.0%CVE-2025-2549MEDIUMD-Link DIR-618/DIR-605L formSetPassword access controlEPSS 1.0%CVE-2017-8438—Elastic X-Pack Security versions 5.0.0 to 5.4.0 contain a privilege escalation bug in the run_as functionality. This bug prevents transitionEPSS 1.0%CVE-2022-40798HIGHOcoMon 4.0RC1 is vulnerable to Incorrect Access Control. Through a request the user can obtain the real email, sending the same request withEPSS 1.0%CVE-2024-24386HIGHAn issue in VitalPBX v.3.2.4-5 allows an attacker to execute arbitrary code via a crafted payload to the /var/lib/vitalpbx/scripts folder.EPSS 1.0%CVE-2022-23730—The public API error causes for the attacker to be able to bypass API access control.EPSS 1.0%CVE-2023-39962HIGHUsers can delete external storage mount pointsEPSS 1.0%CVE-2025-46628HIGHLack of input validation/sanitization in the 'ate' management service in the Tenda RX2 Pro 16.03.30.14 allows an unauthorized remote attackeEPSS 1.0%CVE-2023-24058MEDIUMBooked Scheduler 2.5.5 allows authenticated users to create and schedule events for any other user via a modified userId value to reservatioEPSS 1.0%CVE-2021-21965HIGHA denial of service vulnerability exists in the SeaMax remote configuration functionality of Sealevel Systems, Inc. SeaConnect 370W v1.3.34.EPSS 1.0%CVE-2022-32789MEDIUMA logic issue was addressed with improved checks. This issue is fixed in macOS Monterey 12.5. An app may be able to bypass Privacy preferencEPSS 1.0%CVE-2020-8278—Improper access control in Nextcloud Social app version 0.3.1 allowed to read posts of any user.EPSS 1.0%CVE-2022-23768HIGHNeo Information Sys. NIS-HAP11AC remote access and manipulation vulnerabilityEPSS 1.0%CVE-2024-13108MEDIUMD-Link DIR-816 A2 form2NetSniper.cgi access controlEPSS 1.0%CVE-2021-1478MEDIUMCisco Unified Communications Manager Denial of Service VulnerabilityEPSS 1.0%CVE-2020-26072HIGHCisco IoT Field Network Director SOAP API Authorization Bypass VulnerabilityEPSS 1.0%CVE-2022-0731MEDIUMImproper Access Control (IDOR) in dolibarr/dolibarrEPSS 1.0%CVE-2024-26029HIGHAdobe Experience Manager | Improper Access Control (CWE-284)EPSS 1.0%CVE-2021-34754MEDIUMCisco Firepower Threat Defense Software Ethernet Industrial Protocol Policy Bypass VulnerabilitiesEPSS 1.0%CVE-2023-40060HIGH2FA/MFA Bypass Vulnerability in Serv-U 15.4 and 15.4 Hotfix 1EPSS 1.0%