Weaknesses of type CWE-284

7,967 results

Controle de acesso inadequado a recursos

A aplicação falha em validar ou impõe regras insuficientes para determinar quem pode acessar um recurso (arquivo, API, dados, funcionalidade). Um usuário não autorizado consegue contornar essas restrições e acessar o que não deveria, seja por falta de autenticação, autorização fraca ou lógica de controle de acesso bugada.

Example

Um sistema de gestão de RH permite que qualquer funcionário logado acesse `/api/salarios/{id}` substituindo o ID na URL. Sem verificar se o usuário é gestor ou RH, a API retorna dados salariais de qualquer pessoa da empresa. Um dev junior consegue ver quanto ganha o CTO.

How to mitigate

Implemente verificação explícita de permissões antes de qualquer acesso: confirme autenticação (quem é), autorização (o que pode fazer) e aplique o princípio do menor privilégio. Use listas de controle de acesso (ACL), roles bem definidos e sempre valide no backend, nunca confie em dados do cliente.

CVE-2017-7912—Hanwha Techwin SRN-4000, SRN-4000 firmware versions prior to SRN4000_v2.16_170401, A specially crafted http request and response could allowEPSS 4.4%CVE-2024-25736HIGHAn issue was discovered on WyreStorm Apollo VX20 devices before 1.3.58. Remote attackers can restart the device via a /device/reboot GET reqEPSS 4.3%CVE-2023-26408HIGHZDI-CAN-20712: AnnotsString Object prototype pollution Restrictions Bypass VulnerabilityEPSS 4.3%CVE-2023-26406HIGHZDI-CAN-20712: Net.HTTP.request URL restriction bypassEPSS 4.2%CVE-2021-27258CRITICALThis vulnerability allows remote attackers to execute escalate privileges on affected installations of SolarWinds Orion Platform 2020.2. AutEPSS 4.1%CVE-2024-46627CRITICALIncorrect access control in BECN DATAGERRY v2.2 allows attackers to execute arbitrary commands via crafted web requests.EPSS 4.1%CVE-2022-21476HIGHVulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Libraries). Supported versions EPSS 4.0%CVE-2018-15394CRITICALCisco Stealthwatch Management Console Authentication Bypass VulnerabilityEPSS 4.0%CVE-2026-76455CRITICALCisco NX-OS Software Security Hardening Release: October 2026 - Improper Access Control VulnerabilitiesEPSS 4.0%CVE-2025-14528MEDIUMD-Link DIR-803 Configuration getcfg.php information disclosureEPSS 4.0%CVE-2024-0712HIGHByzoro Smart S150 Management Platform userattea.php access controlEPSS 3.9%CVE-2021-26118—Flaw in ActiveMQ Artemis OpenWire supportEPSS 3.9%CVE-2019-15999MEDIUMCisco Data Center Network Manager JBoss EAP Unauthorized Access VulnerabilityEPSS 3.6%CVE-2019-10950—Fujifilm FCR Capsula X/ Carbon X/ FCR XC-2, model versions CR-IR 357 FCR Carbon X, CR-IR 357 FCR XC-2, FCR-IR 357 FCR Capsula X provide inseEPSS 3.6%CVE-2025-54098HIGHWindows Hyper-V Elevation of Privilege VulnerabilityEPSS 3.6%CVE-2026-86242HIGHUnauthenticated RCE via Custom Plugin HTTP Path on Dynamically Linked BuildsEPSS 3.6%CVE-2025-27738MEDIUMWindows Resilient File System (ReFS) Information Disclosure VulnerabilityEPSS 3.6%CVE-2018-14804—Emerson AMS Device Manager v12.0 to v13.5. A specially crafted script may be run that allows arbitrary remote code execution.EPSS 3.5%CVE-2023-31242HIGHAn authentication bypass vulnerability exists in the OAS Engine functionality of Open Automation Software OAS Platform v18.00.0072. A speciaEPSS 3.5%CVE-2026-20843HIGHWindows Routing and Remote Access Service (RRAS) Elevation of Privilege VulnerabilityEPSS 3.4%