Weaknesses of type CWE-284

7,174 results

Controle de acesso inadequado a recursos

A aplicação falha em validar ou impõe regras insuficientes para determinar quem pode acessar um recurso (arquivo, API, dados, funcionalidade). Um usuário não autorizado consegue contornar essas restrições e acessar o que não deveria, seja por falta de autenticação, autorização fraca ou lógica de controle de acesso bugada.

Example

Um sistema de gestão de RH permite que qualquer funcionário logado acesse `/api/salarios/{id}` substituindo o ID na URL. Sem verificar se o usuário é gestor ou RH, a API retorna dados salariais de qualquer pessoa da empresa. Um dev junior consegue ver quanto ganha o CTO.

How to mitigate

Implemente verificação explícita de permissões antes de qualquer acesso: confirme autenticação (quem é), autorização (o que pode fazer) e aplique o princípio do menor privilégio. Use listas de controle de acesso (ACL), roles bem definidos e sempre valide no backend, nunca confie em dados do cliente.

CVE-2025-48619HIGHIn multiple functions of ContentProvider.java, there is a possible way for an app with read-only access to truncate files due to a logic errEPSS 0.1%CVE-2026-78236HIGHInsecure PIN derivation mechanism in Admin By Request (ABR)EPSS 0.1%CVE-2022-25831LOWImproper access control vulnerability in S Secure prior to SMR Apr-2022 Release 1 allows physical attackers to access secured data in certaiEPSS 0.1%CVE-2023-21642HIGHImproper Access Control in HAB Memory ManagementEPSS 0.1%CVE-2023-24844HIGHImproper Access Control in CoreEPSS 0.1%CVE-2023-21673HIGHImproper Access Control in KernelEPSS 0.1%CVE-2026-41985MEDIUMUAF vulnerability in the package management module. Impact: Successful exploitation of this vulnerability may affect service integrity.EPSS 0.1%CVE-2023-52972MEDIUMHuawei PCs have a vulnerability that allows low-privilege users to bypass SDDL permission checks . Successful exploitation this vulnerabilitEPSS 0.1%CVE-2024-42033MEDIUMAccess control vulnerability in the security verification module mpact: Successful exploitation of this vulnerability will affect integrity EPSS 0.1%CVE-2025-46362MEDIUMDell Alienware Command Center 6.x (AWCC), versions prior to 6.10.15.0, contain an Improper Access Control vulnerability. A low privileged atEPSS 0.1%CVE-2023-43517HIGHImproper Access Control in Automotive MultimediaEPSS 0.1%CVE-2024-33027HIGHImproper Access Control in Graphics LinuxEPSS 0.1%CVE-2026-19574HIGHARM64 MMU can assign an in-use ASID to a new memory domain, breaking user-mode memory isolationEPSS 0.1%CVE-2021-25501MEDIUMAn improper access control vulnerability in SCloudBnRReceiver in SecTelephonyProvider prior to SMR Nov-2021 Release 1 allows untrusted appliEPSS 0.1%CVE-2025-26424MEDIUMIn multiple functions of VpnManager.java, there is a possible cross-user data leak due to a logic error in the code. This could lead to locaEPSS 0.1%CVE-2022-25679MEDIUMDenial of service in video due to improper access control in broadcast receivers in Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon EPSS 0.1%CVE-2024-36323HIGHImproper isolation of VCN-JPEG HW register space could allow a malicious Guest Virtual Machine (VM) or a process to perform unauthorized accEPSS 0.1%CVE-2022-28780MEDIUMImproper access control vulnerability in Weather prior to SMR May-2022 Release 1 allows that attackers can access location information that EPSS 0.1%CVE-2024-20065MEDIUMIn telephony, there is a possible information disclosure due to a missing permission check. This could lead to local information disclosure EPSS 0.1%CVE-2022-40529HIGHImproper access control in KernelEPSS 0.1%