Weaknesses of type CWE-284

7,967 results

Controle de acesso inadequado a recursos

A aplicação falha em validar ou impõe regras insuficientes para determinar quem pode acessar um recurso (arquivo, API, dados, funcionalidade). Um usuário não autorizado consegue contornar essas restrições e acessar o que não deveria, seja por falta de autenticação, autorização fraca ou lógica de controle de acesso bugada.

Example

Um sistema de gestão de RH permite que qualquer funcionário logado acesse `/api/salarios/{id}` substituindo o ID na URL. Sem verificar se o usuário é gestor ou RH, a API retorna dados salariais de qualquer pessoa da empresa. Um dev junior consegue ver quanto ganha o CTO.

How to mitigate

Implemente verificação explícita de permissões antes de qualquer acesso: confirme autenticação (quem é), autorização (o que pode fazer) e aplique o princípio do menor privilégio. Use listas de controle de acesso (ACL), roles bem definidos e sempre valide no backend, nunca confie em dados do cliente.

CVE-2022-39310MEDIUMMalicious agent may be able to impersonate another agent in GoCDEPSS 0.9%CVE-2024-1114MEDIUMopenBI Screen.php dlfile access controlEPSS 0.9%CVE-2024-21145MEDIUMVulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: 2D). SEPSS 0.9%CVE-2021-33013HIGHmySCADA myPRO Improper Access ControlEPSS 0.9%CVE-2022-23132LOWIncorrect permissions of [/var/run/zabbix] forces dac_overrideEPSS 0.9%CVE-2021-25320CRITICALRancher: Cloud credentials can be used through proxy API by users without accessEPSS 0.9%CVE-2026-112946MEDIUMVite: Files outside `server.fs.allow` could be served when project paths match system paths on non-Windows machineEPSS 0.9%CVE-2026-120192MEDIUMPresenton Desktop Authentication Middleware app_data information disclosureEPSS 0.9%CVE-2017-8448—An error was found in the permission model used by X-Pack Alerting 5.0.0 to 5.6.0 whereby users mapped to certain built-in roles could creatEPSS 0.9%CVE-2026-24306CRITICALAzure Front Door Elevation of Privilege VulnerabilityEPSS 0.8%CVE-2020-1604MEDIUMJunos OS: EX4300/EX4600/QFX3500/QFX5100 Series: Stateless IP firewall filter may fail to evaluate certain packetsEPSS 0.8%CVE-2025-21587HIGHVulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JSSE). EPSS 0.8%CVE-2024-13103MEDIUMD-Link DIR-816 A2 Virtual Service form2AddVrtsrv.cgi access controlEPSS 0.8%CVE-2022-31708MEDIUMvRealize Operations (vROps) contains a broken access control vulnerability. VMware has evaluated the severity of this issue to be in the ModEPSS 0.8%CVE-2023-0451HIGHEconolite EOS versions prior to 3.2.23 lack a password requirement for gaining “READONLY” access to log files and certain database and confiEPSS 0.8%CVE-2025-2995MEDIUMTenda FH1202 Web Management Interface SysToolChangePwd access controlEPSS 0.8%CVE-2025-55238HIGHDynamics 365 FastTrack Implementation Assets Information Disclosure VulnerabilityEPSS 0.8%CVE-2022-32255MEDIUMA vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.1). The affected application consists of a web servicEPSS 0.8%CVE-2022-24841MEDIUMImproper Authorization in github.com/fleetdm/fleetEPSS 0.8%CVE-2025-48983CRITICALA vulnerability in the Mount service of Veeam Backup & Replication, which allows for remote code execution (RCE) on the Backup infrastructurEPSS 0.8%