Weaknesses of type CWE-284

7,967 results

Controle de acesso inadequado a recursos

A aplicação falha em validar ou impõe regras insuficientes para determinar quem pode acessar um recurso (arquivo, API, dados, funcionalidade). Um usuário não autorizado consegue contornar essas restrições e acessar o que não deveria, seja por falta de autenticação, autorização fraca ou lógica de controle de acesso bugada.

Example

Um sistema de gestão de RH permite que qualquer funcionário logado acesse `/api/salarios/{id}` substituindo o ID na URL. Sem verificar se o usuário é gestor ou RH, a API retorna dados salariais de qualquer pessoa da empresa. Um dev junior consegue ver quanto ganha o CTO.

How to mitigate

Implemente verificação explícita de permissões antes de qualquer acesso: confirme autenticação (quem é), autorização (o que pode fazer) e aplique o princípio do menor privilégio. Use listas de controle de acesso (ACL), roles bem definidos e sempre valide no backend, nunca confie em dados do cliente.

CVE-2025-22157HIGHThis High severity PrivEsc (Privilege Escalation) vulnerability was introduced in versions: 9.12.0, 10.3.0, 10.4.0, and 10.5.0 of Jira CoreEPSS 0.7%CVE-2022-32256MEDIUMA vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.1). The affected application consists of a web servicEPSS 0.7%CVE-2021-28507MEDIUMAn issue has recently been discovered in Arista EOS where, under certain conditions, the service ACL configured for OpenConfig gNOI and OpenConfig RESTCONF might be bypassed, which results in the denied requests being forwarded to the agent.EPSS 0.7%CVE-2023-6578HIGHSoftware AG WebMethods access controlEPSS 0.7%CVE-2026-24014CRITICALApache IoTDB: Path Traversal in DataNode Internal RPC Trigger JAR Upload Allows Arbitrary File WriteEPSS 0.7%CVE-2022-42126MEDIUMThe Asset Libraries module in Liferay Portal 7.3.5 through 7.4.3.28, and Liferay DXP 7.3 before update 8, and DXP 7.4 before update 29 does EPSS 0.7%CVE-2021-34626MEDIUMWP Upload Restriction <= 2.2.3 - Missing Access Control in deleteCustomType functionEPSS 0.7%CVE-2024-36259HIGHImproper access control in mail module of Odoo Community 17.0 and Odoo Enterprise 17.0 allows remote authenticated attackers to extract sensEPSS 0.7%CVE-2024-29866CRITICALDatalust Seq before 2023.4.11151 and 2024 before 2024.1.11146 has Incorrect Access Control because a Project Owner or Organization Owner canEPSS 0.7%CVE-2023-44031HIGHIncorrect access control in Reprise License Management Software Reprise License Manager v15.1 allows attackers to arbitrarily save sensitiveEPSS 0.7%CVE-2026-56161CRITICALAzure Logic Apps Information Disclosure VulnerabilityEPSS 0.7%CVE-2024-25251HIGHcode-projects Agro-School Management System 1.0 is suffers from Incorrect Access Control.EPSS 0.7%CVE-2025-6161MEDIUMSourceCodester Simple Food Ordering System editproduct.php unrestricted uploadEPSS 0.7%CVE-2021-44460HIGHImproper access control in Odoo Community 13.0 and earlier and Odoo Enterprise 13.0 and earlier allows users with deactivated accounts to acEPSS 0.7%CVE-2025-5299MEDIUMSourceCodester Client Database Management System user_order_customer_update.php unrestricted uploadEPSS 0.7%CVE-2025-3236MEDIUMTenda FH1202 Web Management Interface VirSerDMZ access controlEPSS 0.7%CVE-2024-37147MEDIUMGLPI allows Authenticated File Upload to Restricted TicketsEPSS 0.7%CVE-2020-8122—A missing check in Nextcloud Server 14.0.3 could give recipient the possibility to extend the expiration date of a share they received.EPSS 0.7%CVE-2025-43192CRITICALA configuration issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15.6, macOS Sonoma 14.7.7. Account-drEPSS 0.7%CVE-2022-45431HIGHSome Dahua software products have a vulnerability of unauthenticated restart of remote DSS Server. After bypassing the firewall access contrEPSS 0.7%