Weaknesses of type CWE-284

7,088 results

Controle de acesso inadequado a recursos

A aplicação falha em validar ou impõe regras insuficientes para determinar quem pode acessar um recurso (arquivo, API, dados, funcionalidade). Um usuário não autorizado consegue contornar essas restrições e acessar o que não deveria, seja por falta de autenticação, autorização fraca ou lógica de controle de acesso bugada.

Example

Um sistema de gestão de RH permite que qualquer funcionário logado acesse `/api/salarios/{id}` substituindo o ID na URL. Sem verificar se o usuário é gestor ou RH, a API retorna dados salariais de qualquer pessoa da empresa. Um dev junior consegue ver quanto ganha o CTO.

How to mitigate

Implemente verificação explícita de permissões antes de qualquer acesso: confirme autenticação (quem é), autorização (o que pode fazer) e aplique o princípio do menor privilégio. Use listas de controle de acesso (ACL), roles bem definidos e sempre valide no backend, nunca confie em dados do cliente.

CVE-2023-29051HIGHUser-defined OXMF templates could be used to access a limited part of the internal OX App Suite Java API. The existing switch to disable theEPSS 0.5%CVE-2025-4433HIGHImproper access control in user group management in Devolutions Server 2025.1.7.0 and earlier allows a non-administrative user with both "UsEPSS 0.5%CVE-2019-1805MEDIUMCisco Wireless LAN Controller Secure Shell Unauthorized Access VulnerabilityEPSS 0.5%CVE-2025-5131MEDIUMTmall Demo uploadCategoryImage unrestricted uploadEPSS 0.5%CVE-2023-32333MEDIUMIBM Maximo Asset Management improper access controlEPSS 0.5%CVE-2023-40579MEDIUMOpenFGA Authorization BypassEPSS 0.5%CVE-2024-8779HIGHThe SYSCOM Group OMFLOW - Broken Access ControlEPSS 0.5%CVE-2026-15319MEDIUMSipeed PicoClaw Launcher access_control.go IPAllowlist access controlEPSS 0.5%CVE-2026-73061CRITICALScriban before 7.2.2 Arbitrary Property Write via TypedObjectAccessorEPSS 0.5%CVE-2026-78074HIGHJoomla Extension - miniorgange.com - Unauthenticated arbitrary extension deinstallation via various miniOrange extensionsEPSS 0.5%CVE-2024-53573CRITICALUnifiedtransform v2.X is vulnerable to Incorrect Access Control. Unauthorized users can access and manipulate endpoints intended exclusivelyEPSS 0.5%CVE-2026-82859CRITICALhulumi before v1.3.2 SCP Template Tag-on-Create BypassEPSS 0.5%CVE-2024-35396CRITICALTOTOLINK CP900L v4.1.5cu.798_B20221228 was discovered to contain a hardcoded password for telnet in /web_cste/cgi-bin/product.ini, which allEPSS 0.5%CVE-2024-10766MEDIUMCodezips Free Exam Hall Seating Management System save_user.php unrestricted uploadEPSS 0.5%CVE-2026-31282CRITICALTotara LMS v19.1.5 and before is vulnerable to Incorrect Access Control. The login page code can be manipulated to reveal the login form. AnEPSS 0.5%CVE-2025-63958CRITICALMILLENSYS Vision Tools Workspace 6.5.0.2585 exposes a sensitive configuration endpoint (/MILLENSYS/settings) that is accessible without authEPSS 0.5%CVE-2026-8752MEDIUMh2oai h2o-3 Rapids setproperty Primitive AstSetProperty.java exec access controlEPSS 0.5%CVE-2025-5163MEDIUMyangshare 技术杨工 warehouseManager 仓库管理系统 access controlEPSS 0.5%CVE-2026-64702CRITICALAn access issue was addressed with additional sandbox restrictions. This issue is fixed in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS EPSS 0.5%CVE-2025-52079HIGHThe administrator password setting of the D-Link DIR-820L 1.06B02 is has Improper Access Control and is vulnerable to Unverified Password ChEPSS 0.5%