Weaknesses of type CWE-284

7,076 results

Controle de acesso inadequado a recursos

A aplicação falha em validar ou impõe regras insuficientes para determinar quem pode acessar um recurso (arquivo, API, dados, funcionalidade). Um usuário não autorizado consegue contornar essas restrições e acessar o que não deveria, seja por falta de autenticação, autorização fraca ou lógica de controle de acesso bugada.

Example

Um sistema de gestão de RH permite que qualquer funcionário logado acesse `/api/salarios/{id}` substituindo o ID na URL. Sem verificar se o usuário é gestor ou RH, a API retorna dados salariais de qualquer pessoa da empresa. Um dev junior consegue ver quanto ganha o CTO.

How to mitigate

Implemente verificação explícita de permissões antes de qualquer acesso: confirme autenticação (quem é), autorização (o que pode fazer) e aplique o princípio do menor privilégio. Use listas de controle de acesso (ACL), roles bem definidos e sempre valide no backend, nunca confie em dados do cliente.

CVE-2019-3845HIGHA lack of access control was found in the message queues maintained by Satellite's QPID broker and used by katello-agent in versions before EPSS 0.7%CVE-2022-0727MEDIUMImproper Access Control in chocobozzz/peertubeEPSS 0.7%CVE-2023-2902MEDIUMNFine Rapid Development Platform access controlEPSS 0.7%CVE-2025-26616CRITICALPath Traversal endpoint 'exportar_dump.php' parameter 'file' in WeGIAEPSS 0.7%CVE-2024-1294MEDIUMSunshine Photo Cart: Free Client Galleries for Photographers <= 3.0.24 - Unauthenticated Sensitive Information Exposure via InvoiceEPSS 0.7%CVE-2019-25157MEDIUMEthex Contracts Monthly Jackpot EthexJackpot.sol access controlEPSS 0.7%CVE-2025-69691CRITICALNetgate pfSense CE 2.8.0 allows code execution in the XMLRPC API via pfsense.exec_php. NOTE: the Supplier disputes this because the API callEPSS 0.7%CVE-2026-31874CRITICALTaskosaur Improper Role Assignment via Parameter Manipulation in User RegistrationEPSS 0.7%CVE-2026-24304CRITICALAzure Resource Manager Elevation of Privilege VulnerabilityEPSS 0.7%CVE-2021-1477MEDIUMCisco Firepower Management Center Software Policy VulnerabilityEPSS 0.7%CVE-2026-3749MEDIUMBytedesk SVG File UploadRestService.java handleFileUpload unrestricted uploadEPSS 0.7%CVE-2021-24698—Simple Download Monitor < 3.9.6 - Arbitrary Thumbnails RemovalEPSS 0.7%CVE-2020-3329MEDIUMCisco IMC Supervisor, Cisco UCS Director, and Cisco UCS Director Express for Big Data Role-Based Access Control VulnerabilityEPSS 0.7%CVE-2025-14286MEDIUMTenda AC9 Configuration File DownloadCfg.jpg information disclosureEPSS 0.7%CVE-2021-24816—Phoenix Media Rename < 3.4.4 - Author Arbitrary Media File RenamingEPSS 0.7%CVE-2022-2052CRITICALTRUMPF TruTops default user accounts vulnerabilityEPSS 0.7%CVE-2026-8750MEDIUMh2oai h2o-3 ImportFile API PersistNFS.java importFiles information disclosureEPSS 0.7%CVE-2026-35904CRITICALIncorrect access control in the web management interface of T3 Technology CPE models T625Pro v1.0.07, T6825G v1.0.03, and T7281 v1.0.03 alloEPSS 0.7%CVE-2022-25650—A vulnerability has been identified in Mendix Applications using Mendix 7 (All versions < V7.23.27), Mendix Applications using Mendix 8 (AllEPSS 0.7%CVE-2025-1598MEDIUMSourceCodester Best Church Management Software asset_crud.php unrestricted uploadEPSS 0.7%