Weaknesses of type CWE-284

7,076 results

Controle de acesso inadequado a recursos

A aplicação falha em validar ou impõe regras insuficientes para determinar quem pode acessar um recurso (arquivo, API, dados, funcionalidade). Um usuário não autorizado consegue contornar essas restrições e acessar o que não deveria, seja por falta de autenticação, autorização fraca ou lógica de controle de acesso bugada.

Example

Um sistema de gestão de RH permite que qualquer funcionário logado acesse `/api/salarios/{id}` substituindo o ID na URL. Sem verificar se o usuário é gestor ou RH, a API retorna dados salariais de qualquer pessoa da empresa. Um dev junior consegue ver quanto ganha o CTO.

How to mitigate

Implemente verificação explícita de permissões antes de qualquer acesso: confirme autenticação (quem é), autorização (o que pode fazer) e aplique o princípio do menor privilégio. Use listas de controle de acesso (ACL), roles bem definidos e sempre valide no backend, nunca confie em dados do cliente.

CVE-2024-0377MEDIUMLifterLMS – WordPress LMS Plugin for eLearning <= 7.5.1 - Missing Authorization via process_reviewEPSS 0.7%CVE-2022-1066HIGHMISSING AUTHORIZATION CWE-862EPSS 0.7%CVE-2019-11896MEDIUMIncorrect pviilege assignment in the 3rd party pairing mechanism of the Bosch Smart Home Controller (SHC)EPSS 0.7%CVE-2025-30707HIGHVulnerability in the Oracle iStore product of Oracle E-Business Suite (component: User Management). Supported versions that are affected arEPSS 0.7%CVE-2023-29513MEDIUMUsers can be created even when registration is disabled without validation via the template macro in xwiki-platformEPSS 0.7%CVE-2025-4118MEDIUMWeitong Mall Product History historyList access controlEPSS 0.7%CVE-2025-3236MEDIUMTenda FH1202 Web Management Interface VirSerDMZ access controlEPSS 0.7%CVE-2025-0702MEDIUMJoeyBling bootplus SysFileController.java unrestricted uploadEPSS 0.7%CVE-2023-48303LOWNextcloud Server admins can change authentication details of user configured external storageEPSS 0.7%CVE-2026-2669MEDIUMRongzhitong Visual Integrated Command and Dispatch Platform User delete access controlEPSS 0.7%CVE-2021-46304MEDIUMA vulnerability has been identified in CP-8000 MASTER MODULE WITH I/O -25/+70°C (All versions), CP-8000 MASTER MODULE WITH I/O -40/+70°C (AlEPSS 0.7%CVE-2022-0273MEDIUMImproper Access Control in janeczku/calibre-webEPSS 0.7%CVE-2026-35172HIGHDistribution has stale blob access resurrection via repo-scoped redis descriptor cache invalidationEPSS 0.7%CVE-2021-28507MEDIUMAn issue has recently been discovered in Arista EOS where, under certain conditions, the service ACL configured for OpenConfig gNOI and OpenConfig RESTCONF might be bypassed, which results in the denied requests being forwarded to the agent.EPSS 0.7%CVE-2023-22807CRITICALCVE-2023-22807EPSS 0.7%CVE-2019-3779HIGHCloud Foundry Container Runtime allows a user to bypass security policy when talking to ETCDEPSS 0.7%CVE-2023-24905HIGHRemote Desktop Client Remote Code Execution VulnerabilityEPSS 0.7%CVE-2023-22285HIGHImproper access control for some Intel Unison software may allow an unauthenticated user to potentially enable denial of service via networkEPSS 0.7%CVE-2024-46609HIGHAn access control issue in the CheckVip function in UserController.java of IceCMS v3.4.7 and before allows unauthenticated attackers to acceEPSS 0.7%CVE-2022-25932HIGHThe firmware of InHand Networks InRouter302 V3.5.45 introduces fixes for TALOS-2022-1472 and TALOS-2022-1474. The fixes are incomplete. An aEPSS 0.7%