Weaknesses of type CWE-284

7,082 results

Controle de acesso inadequado a recursos

A aplicação falha em validar ou impõe regras insuficientes para determinar quem pode acessar um recurso (arquivo, API, dados, funcionalidade). Um usuário não autorizado consegue contornar essas restrições e acessar o que não deveria, seja por falta de autenticação, autorização fraca ou lógica de controle de acesso bugada.

Example

Um sistema de gestão de RH permite que qualquer funcionário logado acesse `/api/salarios/{id}` substituindo o ID na URL. Sem verificar se o usuário é gestor ou RH, a API retorna dados salariais de qualquer pessoa da empresa. Um dev junior consegue ver quanto ganha o CTO.

How to mitigate

Implemente verificação explícita de permissões antes de qualquer acesso: confirme autenticação (quem é), autorização (o que pode fazer) e aplique o princípio do menor privilégio. Use listas de controle de acesso (ACL), roles bem definidos e sempre valide no backend, nunca confie em dados do cliente.

CVE-2023-51661HIGHFilesystem sandbox not enforced in wasmer-cliEPSS 0.6%CVE-2025-29514CRITICALIncorrect access control in the config.xgi function of D-Link DSL-7740C with firmware DSL7740C.V6.TR069.20211230 allows attackers to downloaEPSS 0.6%CVE-2024-38016HIGHMicrosoft Office Visio Remote Code Execution VulnerabilityEPSS 0.6%CVE-2025-4066MEDIUMScriptAndTools Online-Travling-System addpackage.php access controlEPSS 0.6%CVE-2025-11028MEDIUMgivanz Vvveb Image information disclosureEPSS 0.6%CVE-2022-41677MEDIUMAn information disclosure vulnerability was discovered in Bosch IP camera devices allowing an unauthenticated attacker to retrieve informatiEPSS 0.6%CVE-2025-11657MEDIUMProjectsAndPrograms School Management System createNotice.php unrestricted uploadEPSS 0.6%CVE-2025-11659MEDIUMProjectsAndPrograms School Management System uploadNotes.php unrestricted uploadEPSS 0.6%CVE-2025-11656MEDIUMProjectsAndPrograms School Management System editNotes.php unrestricted uploadEPSS 0.6%CVE-2023-21893HIGHVulnerability in the Oracle Data Provider for .NET component of Oracle Database Server. Supported versions that are affected are 19c and 2EPSS 0.6%CVE-2026-76709CRITICALUnauthenticated Remote Arbitrary File Write Vulnerability in HPE Networking Analytics and Location Engine (ALE)EPSS 0.6%CVE-2026-59720HIGHHoppscotch: Insecure Default Configuration Allows Public Exposure of Private Collection Data via Mock ServerEPSS 0.6%CVE-2022-34894LOWIn JetBrains Hub before 2022.2.14799, insufficient access control allowed the hijacking of untrusted servicesEPSS 0.6%CVE-2024-12984MEDIUMAmcrest IP2M-841B Web Interface webCapsConfig information disclosureEPSS 0.6%CVE-2025-3674MEDIUMTOTOLINK A3700R cstecgi.cgi setUrlFilterRules access controlEPSS 0.6%CVE-2023-21923HIGHVulnerability in the Oracle Health Sciences InForm product of Oracle Health Sciences Applications (component: Core). Supported versions thaEPSS 0.6%CVE-2026-42812CRITICALApache Polaris: No protection on `write.metadata.path`EPSS 0.6%CVE-2023-1432HIGHSourceCodester Online Food Ordering System POST Request access controlEPSS 0.6%CVE-2026-33318HIGHActual has Privilege Escalation via 'change-password' Endpoint on OpenID-Migrated ServersEPSS 0.6%CVE-2023-52801HIGHiommufd: Fix missing update of domains_itree after splitting iopt_areaEPSS 0.6%