Weaknesses of type CWE-284

7,174 results

Controle de acesso inadequado a recursos

A aplicação falha em validar ou impõe regras insuficientes para determinar quem pode acessar um recurso (arquivo, API, dados, funcionalidade). Um usuário não autorizado consegue contornar essas restrições e acessar o que não deveria, seja por falta de autenticação, autorização fraca ou lógica de controle de acesso bugada.

Example

Um sistema de gestão de RH permite que qualquer funcionário logado acesse `/api/salarios/{id}` substituindo o ID na URL. Sem verificar se o usuário é gestor ou RH, a API retorna dados salariais de qualquer pessoa da empresa. Um dev junior consegue ver quanto ganha o CTO.

How to mitigate

Implemente verificação explícita de permissões antes de qualquer acesso: confirme autenticação (quem é), autorização (o que pode fazer) e aplique o princípio do menor privilégio. Use listas de controle de acesso (ACL), roles bem definidos e sempre valide no backend, nunca confie em dados do cliente.

CVE-2022-30751LOWImproper access control vulnerability in sendDHCPACKBroadcast function of SemWifiApClient prior to SMR Jul-2022 Release 1 allows attacker toEPSS 0.1%CVE-2022-30750LOWImproper access control vulnerability in updateLastConnectedClientInfo function of SemWifiApClient prior to SMR Jul-2022 Release 1 allows atEPSS 0.1%CVE-2025-21470HIGHImproper Access Control in Camera DriverEPSS 0.1%CVE-2025-21425HIGHImproper Access Control in Automotive Linux OSEPSS 0.1%CVE-2025-21469HIGHImproper Access Control in Camera DriverEPSS 0.1%CVE-2024-49842HIGHImproper Access Control in HypervisorEPSS 0.1%CVE-2022-30752LOWImproper access control vulnerability in sendDHCPACKBroadcast function of SemWifiApClient prior to SMR Jul-2022 Release 1 allows attacker toEPSS 0.1%CVE-2026-21100MEDIUMImproper access control in SystemUI prior to SMR Sep-2026 Release 1 allows local attackers to launch arbitrary activity.EPSS 0.1%CVE-2026-21105MEDIUMImproper access control in Collection prior to version 1.0.1.14 in Android 15 and 2.0.02.7 in Android 16 allows local attackers to access seEPSS 0.1%CVE-2026-28602HIGHIn setClipboardAccessNotificationsEnabledForUser of ClipboardService.java, there is a possible mult-iuser isolation due to a logic error in EPSS 0.1%CVE-2024-23360HIGHImproper Access Control in Graphics WindowsEPSS 0.1%CVE-2026-21098MEDIUMImproper access control in Link to Windows prior to SMR Sep-2026 Release 1 allows local attackers to establish a connection with the PC withEPSS 0.1%CVE-2022-33714MEDIUMImproper access control vulnerability in SemWifiApBroadcastReceiver prior to SMR Aug-2022 Release 1 allows attacker to reset a setting valueEPSS 0.1%CVE-2022-33731MEDIUMImproper access control vulnerability in DesktopSystemUI prior to SMR Aug-2022 Release 1 allows attackers to enable and disable arbitrary coEPSS 0.1%CVE-2026-20716HIGHImproper access control for some Intel(R) Processors within Ring 3: User Applications may allow an escalation of privilege. Simple hardware EPSS 0.1%CVE-2022-36856MEDIUMImproper access control vulnerability in Telecom application prior to SMR Sep-2022 Release 1 allows attacker to start emergency calls via unEPSS 0.1%CVE-2022-33701LOWImproper access control vulnerability in KnoxCustomManagerService prior to SMR Jul-2022 Release 1 allows attacker to call PowerManaer.goToSlEPSS 0.1%CVE-2023-32479MEDIUM Dell Encryption, Dell Endpoint Security Suite Enterprise, and Dell Security Management Server versions prior to 11.9.0 contain privilege esEPSS 0.1%CVE-2023-20927HIGHIn permissions of AndroidManifest.xml, there is a possible way to grant signature permissions due to a permissions bypass. This could lead tEPSS 0.1%CVE-2024-53010HIGHImproper Access Control in CoreEPSS 0.1%