Weaknesses of type CWE-284

7,174 results

Controle de acesso inadequado a recursos

A aplicação falha em validar ou impõe regras insuficientes para determinar quem pode acessar um recurso (arquivo, API, dados, funcionalidade). Um usuário não autorizado consegue contornar essas restrições e acessar o que não deveria, seja por falta de autenticação, autorização fraca ou lógica de controle de acesso bugada.

Example

Um sistema de gestão de RH permite que qualquer funcionário logado acesse `/api/salarios/{id}` substituindo o ID na URL. Sem verificar se o usuário é gestor ou RH, a API retorna dados salariais de qualquer pessoa da empresa. Um dev junior consegue ver quanto ganha o CTO.

How to mitigate

Implemente verificação explícita de permissões antes de qualquer acesso: confirme autenticação (quem é), autorização (o que pode fazer) e aplique o princípio do menor privilégio. Use listas de controle de acesso (ACL), roles bem definidos e sempre valide no backend, nunca confie em dados do cliente.

CVE-2026-20898HIGHImproper access control in the firmware for some in Alias Checking Trusted Module for some Intel(R) Xeon(R) processors may allow an escalatiEPSS 0.1%CVE-2024-11358MEDIUMInsecure Android File Provider PathsEPSS 0.1%CVE-2025-10491HIGHMongoDB Windows installation MSI may leave ACLs unset on custom installation directoriesEPSS 0.1%CVE-2026-8586MEDIUMInappropriate implementation in Chromoting in Google Chrome prior to 148.0.7778.168 allowed a local attacker to bypass discretionary access EPSS 0.1%CVE-2026-70784MEDIUMVulnerability in the Oracle Hyperion Financial Reporting product of Oracle Hyperion (component: Server). The supported version that is affEPSS 0.1%CVE-2022-39850—Improper access control in mum_container_policy service prior to SMR Oct-2022 Release 1 allows allows unauthorized read of configuration datEPSS 0.1%CVE-2026-20741HIGHImproper access control for some Intel(R) PROSet/Wireless WiFi Software within Ring 2: Device Drivers may allow a denial of service. UnpriviEPSS 0.1%CVE-2026-70758MEDIUMVulnerability in the Oracle Hyperion Financial Reporting product of Oracle Hyperion (component: Server). The supported version that is affEPSS 0.1%CVE-2025-24165MEDIUMA permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15.4, macOS Sonoma 14.7.5, macOS VenturEPSS 0.1%CVE-2022-39849—Improper access control in knox_vpn_policy service prior to SMR Oct-2022 Release 1 allows allows unauthorized read of configuration data.EPSS 0.1%CVE-2026-60962MEDIUMVulnerability in the Oracle Flow Manufacturing product of Oracle E-Business Suite (component: Internal Operations). Supported versions thatEPSS 0.1%CVE-2025-49154HIGHAn insecure access control vulnerability in Trend Micro Apex One and Trend Micro Worry-Free Business Security could allow a local attacker tEPSS 0.1%CVE-2025-43524HIGHAn access issue was addressed with additional sandbox restrictions. This issue is fixed in macOS Sequoia 15.7.7, macOS Sonoma 14.8.7, macOS EPSS 0.1%CVE-2023-52367HIGHVulnerability of improper access control in the media library module.Successful exploitation of this vulnerability may affect service availaEPSS 0.1%CVE-2022-39895MEDIUMImproper access control vulnerability in ContactListUtils in Phone prior to SMR Dec-2022 Release 1 allows to access contact group informatioEPSS 0.1%CVE-2026-106580MEDIUMImageMagick: Policy Bypass in CUT encoderEPSS 0.1%CVE-2026-70794MEDIUMVulnerability in the Oracle Hyperion Financial Reporting product of Oracle Hyperion (component: Server). The supported version that is affEPSS 0.1%CVE-2022-39894MEDIUMImproper access control vulnerability in ContactListStartActivityHelper in Phone prior to SMR Dec-2022 Release 1 allows to access sensitive EPSS 0.1%CVE-2026-13914MEDIUMInappropriate implementation in Passwords in Google Chrome on Mac prior to 150.0.7871.47 allowed a local attacker to obtain potentially sensEPSS 0.1%CVE-2026-60158MEDIUMVulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version that is affected is 7.EPSS 0.1%