Weaknesses of type CWE-284

7,169 results

Controle de acesso inadequado a recursos

A aplicação falha em validar ou impõe regras insuficientes para determinar quem pode acessar um recurso (arquivo, API, dados, funcionalidade). Um usuário não autorizado consegue contornar essas restrições e acessar o que não deveria, seja por falta de autenticação, autorização fraca ou lógica de controle de acesso bugada.

Example

Um sistema de gestão de RH permite que qualquer funcionário logado acesse `/api/salarios/{id}` substituindo o ID na URL. Sem verificar se o usuário é gestor ou RH, a API retorna dados salariais de qualquer pessoa da empresa. Um dev junior consegue ver quanto ganha o CTO.

How to mitigate

Implemente verificação explícita de permissões antes de qualquer acesso: confirme autenticação (quem é), autorização (o que pode fazer) e aplique o princípio do menor privilégio. Use listas de controle de acesso (ACL), roles bem definidos e sempre valide no backend, nunca confie em dados do cliente.

CVE-2025-3768MEDIUMImproper access control in Tor network blocking feature in Devolutions Server 2025.1.10.0 and earlier allows an authenticated user to bypassEPSS 0.3%CVE-2026-28374MEDIUMIDOR in Annotations API allows unprivileged users to DELETE annotationEPSS 0.3%CVE-2025-24887MEDIUMOpenCTI bypass of protected attribute updateEPSS 0.3%CVE-2024-44914MEDIUMAn issue in the component EXR!ReadEXR+0x3df50 of Irfanview v4.67.1.0 allows attackers to cause an access violation via a crafted EXR file. TEPSS 0.3%CVE-2026-1964MEDIUMWeKan REST Endpoint boards.js BoardTitleRESTBleed access controlEPSS 0.3%CVE-2026-12698MEDIUMwpForo Forum < 3.1.3 - Subscriber+ Account Status and Reputation Manipulation via Profile Update Mass AssignmentEPSS 0.3%CVE-2026-41123MEDIUMDell PowerProtect Data Domain, versions 7.7.1.0 through 8.6, LTS2026 release version 8.6.1.0 through 8.6.1.10, LTS2025 release version 8.3.1EPSS 0.3%CVE-2026-11466MEDIUMzilliztech deep-searcher collection_router.py CollectionRouter.invoke access controlEPSS 0.3%CVE-2026-1445MEDIUMiJason-Liu Books_Manager upload_bookCover.php unrestricted uploadEPSS 0.3%CVE-2026-71088MEDIUMVulnerability in the Oracle Agile PLM MCAD Connector product of Oracle Supply Chain (component: CAX Client). The supported version that isEPSS 0.3%CVE-2021-1231MEDIUMCisco Nexus 9000 Series Fabric Switches ACI Mode Link Layer Discovery Protocol Port Denial of Service VulnerabilityEPSS 0.3%CVE-2026-51901HIGHSuperAGI up to 0.0.14 is vulnerable to Incorrect Access Control. The agent execution controller endpoint /api/agentexecutions/schedule allowEPSS 0.3%CVE-2026-82368HIGHInsecure access controls on internal service ports in Brocade SANnav versions before 3.0.1a allow local, non-administrative host users to coEPSS 0.3%CVE-2025-15141LOWHalo Configuration actuator information disclosureEPSS 0.3%CVE-2025-30732MEDIUMVulnerability in the Oracle Application Object Library product of Oracle E-Business Suite (component: Core). Supported versions that are afEPSS 0.3%CVE-2024-47145LOWUnauthorized access on archived channels via file linksEPSS 0.3%CVE-2022-32904MEDIUMAn access issue was addressed with additional sandbox restrictions. This issue is fixed in macOS Big Sur 11.7, macOS Ventura 13, macOS MonteEPSS 0.3%CVE-2025-2350MEDIUMIROAD Dash Cam FX2 upload_file unrestricted uploadEPSS 0.3%CVE-2026-2183MEDIUMGreat Developers Certificate Generation System csv.php unrestricted uploadEPSS 0.3%CVE-2026-3940MEDIUMInsufficient policy enforcement in DevTools in Google Chrome prior to 146.0.7680.71 allowed a remote attacker to bypass navigation restrictiEPSS 0.3%