Weaknesses of type CWE-284

7,074 results

Controle de acesso inadequado a recursos

A aplicação falha em validar ou impõe regras insuficientes para determinar quem pode acessar um recurso (arquivo, API, dados, funcionalidade). Um usuário não autorizado consegue contornar essas restrições e acessar o que não deveria, seja por falta de autenticação, autorização fraca ou lógica de controle de acesso bugada.

Example

Um sistema de gestão de RH permite que qualquer funcionário logado acesse `/api/salarios/{id}` substituindo o ID na URL. Sem verificar se o usuário é gestor ou RH, a API retorna dados salariais de qualquer pessoa da empresa. Um dev junior consegue ver quanto ganha o CTO.

How to mitigate

Implemente verificação explícita de permissões antes de qualquer acesso: confirme autenticação (quem é), autorização (o que pode fazer) e aplique o princípio do menor privilégio. Use listas de controle de acesso (ACL), roles bem definidos e sempre valide no backend, nunca confie em dados do cliente.

CVE-2026-3025MEDIUMShuoRen Smart Heating Integrated Management Platform ExampleNodeService.asmx unrestricted uploadEPSS 0.7%CVE-2023-6758MEDIUMThecosy IceCMS API PlanetCommentList access controlEPSS 0.7%CVE-2022-41155MEDIUMWordPress iQ Block Country plugin <= 1.2.18 - Block BYPASS vulnerabilityEPSS 0.7%CVE-2022-28761MEDIUMZoom On-Premise Deployments: Improper Access ControlEPSS 0.7%CVE-2023-3018MEDIUMSourceCodester Lost and Found Information System access controlEPSS 0.7%CVE-2021-28504HIGHOn Arista Strata family products which have “TCAM profile” feature enabled when Port IPv4 access-list has a rule which matches on “vxlan” as protocol then that rule and subsequent rules ( rules declared after it in ACL ) do not match on IP protocol fi ...EPSS 0.7%CVE-2023-25150MEDIUMDocument content of files can be obtained through Collabora for files of other usersEPSS 0.7%CVE-2026-26418HIGHMissing authentication and authorization in the web API of Tata Consultancy Services Cognix Recon Client v3.0 allows remote attackers to accEPSS 0.7%CVE-2011-1762—A flaw exists in Wordpress related to the 'wp-admin/press-this.php 'script improperly checking user permissions when publishing posts. This EPSS 0.7%CVE-2026-48204CRITICALApache Camel: Camel-MongoDB-GridFS: The gridfs.* control headers used non-Camel-prefixed names that bypass the HTTP header filter, allowing an HTTP client to switch the GridFS operation - including destructive file deletion - in the default configurationEPSS 0.7%CVE-2023-41322MEDIUMPrivilege Escalation from technician to super-admin in GLPIEPSS 0.7%CVE-2024-33898CRITICALAxiros AXESS Auto Configuration Server (ACS) 4.x and 5.0.0 is affected by an Incorrect Access Control vulnerability. An authorization bypassEPSS 0.7%CVE-2026-45177CRITICALIdira Secrets Manager SaaS Edge: Authentication Bypass of an internal validation mechanismEPSS 0.7%CVE-2022-45778CRITICALhttps://www.hillstonenet.com.cn/ Hillstone Firewall SG-6000 <= 5.0.4.0 is vulnerable to Incorrect Access Control. There is a permission bypaEPSS 0.7%CVE-2026-2894MEDIUMfunadmin forget.html getMember information disclosureEPSS 0.7%CVE-2023-25161LOWNextcloud Server's missing rate limiting on password reset functionality allows sending lots of emailsEPSS 0.7%CVE-2022-1958MEDIUMFileCloud NTFS access controlEPSS 0.7%CVE-2019-15998MEDIUMCisco IOS XR Software NETCONF Over Secure Shell ACL Bypass VulnerabilityEPSS 0.7%CVE-2020-15102MEDIUMImproper access control on dashboard form in PrestaShopEPSS 0.7%CVE-2024-56883HIGHSage DPW before 2024_12_001 is vulnerable to Incorrect Access Control. The implemented role-based access controls are not always enforced onEPSS 0.7%