Weaknesses of type CWE-284

7,967 results

Controle de acesso inadequado a recursos

A aplicação falha em validar ou impõe regras insuficientes para determinar quem pode acessar um recurso (arquivo, API, dados, funcionalidade). Um usuário não autorizado consegue contornar essas restrições e acessar o que não deveria, seja por falta de autenticação, autorização fraca ou lógica de controle de acesso bugada.

Example

Um sistema de gestão de RH permite que qualquer funcionário logado acesse `/api/salarios/{id}` substituindo o ID na URL. Sem verificar se o usuário é gestor ou RH, a API retorna dados salariais de qualquer pessoa da empresa. Um dev junior consegue ver quanto ganha o CTO.

How to mitigate

Implemente verificação explícita de permissões antes de qualquer acesso: confirme autenticação (quem é), autorização (o que pode fazer) e aplique o princípio do menor privilégio. Use listas de controle de acesso (ACL), roles bem definidos e sempre valide no backend, nunca confie em dados do cliente.

CVE-2024-44313HIGHTastyIgniter 3.7.6 contains an Incorrect Access Control vulnerability in the invoice() function within Orders.php which allows unauthorized EPSS 0.7%CVE-2022-46664HIGHA vulnerability has been identified in Mendix Workflow Commons (All versions < V2.4.0), Mendix Workflow Commons V2.1 (All versions < V2.1.4)EPSS 0.7%CVE-2021-35249MEDIUMDomain Admin Broken Access ControlEPSS 0.7%CVE-2025-53763CRITICALAzure Databricks Elevation of Privilege VulnerabilityEPSS 0.7%CVE-2024-54533HIGHA permissions issue was addressed with additional sandbox restrictions. This issue is fixed in macOS Sequoia 15.2, macOS Sonoma 14.7.5, macOEPSS 0.7%CVE-2023-25150MEDIUMDocument content of files can be obtained through Collabora for files of other usersEPSS 0.7%CVE-2024-45432HIGHOpenSynergy BlueSDK (aka Blue SDK) through 6.x mishandles a function call. The specific flaw exists within the BlueSDK Bluetooth stack. The EPSS 0.7%CVE-2023-3018MEDIUMSourceCodester Lost and Found Information System access controlEPSS 0.7%CVE-2021-28504HIGHOn Arista Strata family products which have “TCAM profile” feature enabled when Port IPv4 access-list has a rule which matches on “vxlan” as protocol then that rule and subsequent rules ( rules declared after it in ACL ) do not match on IP protocol fi ...EPSS 0.7%CVE-2011-1762—A flaw exists in Wordpress related to the 'wp-admin/press-this.php 'script improperly checking user permissions when publishing posts. This EPSS 0.7%CVE-2022-2578MEDIUMSourceCodester Garage Management System createUser.php access controlEPSS 0.7%CVE-2025-14286MEDIUMTenda AC9 Configuration File DownloadCfg.jpg information disclosureEPSS 0.7%CVE-2026-48204CRITICALApache Camel: Camel-MongoDB-GridFS: The gridfs.* control headers used non-Camel-prefixed names that bypass the HTTP header filter, allowing an HTTP client to switch the GridFS operation - including destructive file deletion - in the default configurationEPSS 0.7%CVE-2026-2550CRITICALEFM iptime A6004MX timepro.cgi commit_vpncli_file_upload unrestricted uploadEPSS 0.7%CVE-2024-33898CRITICALAxiros AXESS Auto Configuration Server (ACS) 4.x and 5.0.0 is affected by an Incorrect Access Control vulnerability. An authorization bypassEPSS 0.7%CVE-2021-4194MEDIUMImproper Access Control in bookstackapp/bookstackEPSS 0.7%CVE-2023-25161LOWNextcloud Server's missing rate limiting on password reset functionality allows sending lots of emailsEPSS 0.7%CVE-2022-4711MEDIUMRoyal Elementor Addons <= 1.3.59 - Insufficient Access Control to Menu Settings UpdateEPSS 0.7%CVE-2019-15998MEDIUMCisco IOS XR Software NETCONF Over Secure Shell ACL Bypass VulnerabilityEPSS 0.7%CVE-2024-56883HIGHSage DPW before 2024_12_001 is vulnerable to Incorrect Access Control. The implemented role-based access controls are not always enforced onEPSS 0.7%