Weaknesses of type CWE-284

7,967 results

Controle de acesso inadequado a recursos

A aplicação falha em validar ou impõe regras insuficientes para determinar quem pode acessar um recurso (arquivo, API, dados, funcionalidade). Um usuário não autorizado consegue contornar essas restrições e acessar o que não deveria, seja por falta de autenticação, autorização fraca ou lógica de controle de acesso bugada.

Example

Um sistema de gestão de RH permite que qualquer funcionário logado acesse `/api/salarios/{id}` substituindo o ID na URL. Sem verificar se o usuário é gestor ou RH, a API retorna dados salariais de qualquer pessoa da empresa. Um dev junior consegue ver quanto ganha o CTO.

How to mitigate

Implemente verificação explícita de permissões antes de qualquer acesso: confirme autenticação (quem é), autorização (o que pode fazer) e aplique o princípio do menor privilégio. Use listas de controle de acesso (ACL), roles bem definidos e sempre valide no backend, nunca confie em dados do cliente.

CVE-2025-24229HIGHA logic issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15.4, macOS Sonoma 14.7.5, macOS Ventura 13.7.5. A saEPSS 0.8%CVE-2021-24781—Image Source Control < 2.3.1 - Contributor+ Arbitrary Post Meta Value ChangeEPSS 0.8%CVE-2026-78745CRITICALAn issue in HiDPT/ Weyon HiDPTAndroid Hi3751V350 Hi3751V352E_DMO allows a remote attacker to execute arbitrary code via the Android Debug BrEPSS 0.8%CVE-2026-68004CRITICALAn issue in OSSRS SRS (Simple Realtime Server) <v5.0.213 allows a remote attacker to execute arbitrary code via RTMP publish authorization, EPSS 0.8%CVE-2022-4689HIGHImproper Access Control in usememos/memosEPSS 0.8%CVE-2023-6761MEDIUMThecosy IceCMS User Data access controlEPSS 0.8%CVE-2025-14749MEDIUMNingyuanda TC155 ONVIF PTZ Control device_service access controlEPSS 0.8%CVE-2025-43194CRITICALThe issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15.6, macOS Sonoma 14.7.7, macOS Ventura 13.7.7. An app mEPSS 0.8%CVE-2025-2550MEDIUMD-Link DIR-618/DIR-605L DDNS Service formSetDDNS access controlEPSS 0.8%CVE-2025-2551MEDIUMD-Link DIR-618/DIR-605L formSetPortTr access controlEPSS 0.8%CVE-2018-0484MEDIUMCisco IOS and IOS XE Software Secure Shell Connection on VRF VulnerabilityEPSS 0.8%CVE-2025-2552MEDIUMD-Link DIR-618/DIR-605L formTcpipSetup access controlEPSS 0.8%CVE-2017-18035—The /rest/review-coverage-chart/1.0/data/<repository_name>/.json resource in Atlassian Fisheye and Crucible before version 4.5.1 and 4.6.0 wEPSS 0.8%CVE-2025-2547MEDIUMD-Link DIR-618/DIR-605L formAdvNetwork access controlEPSS 0.8%CVE-2024-38175CRITICALAzure Managed Instance for Apache Cassandra Elevation of Privilege VulnerabilityEPSS 0.8%CVE-2023-43141—TOTOLINK A3700R V9.1.2u.6134_B20201202 and N600R V5.3c.5137 are vulnerable to Incorrect Access Control.EPSS 0.8%CVE-2026-58617HIGHM365 Copilot for iOS Elevation of Privilege VulnerabilityEPSS 0.8%CVE-2023-26474CRITICALXWiki Platform vulnerable to privilege escalation via properties with wiki syntax that are executed with wrong authorEPSS 0.8%CVE-2025-24259CRITICALThis issue was addressed with additional entitlement checks. This issue is fixed in iPadOS 17.7.7, macOS Sequoia 15.4, macOS Sonoma 14.7.5, EPSS 0.8%CVE-2023-41721CRITICALInstances of UniFi Network Application that (i) are run on a UniFi Gateway Console, and (ii) are versions 7.5.176. and earlier, implement deEPSS 0.8%