Weaknesses of type CWE-284

7,088 results

Controle de acesso inadequado a recursos

A aplicação falha em validar ou impõe regras insuficientes para determinar quem pode acessar um recurso (arquivo, API, dados, funcionalidade). Um usuário não autorizado consegue contornar essas restrições e acessar o que não deveria, seja por falta de autenticação, autorização fraca ou lógica de controle de acesso bugada.

Example

Um sistema de gestão de RH permite que qualquer funcionário logado acesse `/api/salarios/{id}` substituindo o ID na URL. Sem verificar se o usuário é gestor ou RH, a API retorna dados salariais de qualquer pessoa da empresa. Um dev junior consegue ver quanto ganha o CTO.

How to mitigate

Implemente verificação explícita de permissões antes de qualquer acesso: confirme autenticação (quem é), autorização (o que pode fazer) e aplique o princípio do menor privilégio. Use listas de controle de acesso (ACL), roles bem definidos e sempre valide no backend, nunca confie em dados do cliente.

CVE-2021-28129—DEB packaging for Apache OpenOffice 4.1.8 installed with a non-root userid and groupidEPSS 0.5%CVE-2022-1656MEDIUMJupiterX Theme <= 2.0.6 and JupiterX Core <= 2.0.6 - Authenticated Arbitrary Plugin Deactivation and Settings ModificationEPSS 0.5%CVE-2026-8028MEDIUMFlowiseAI Flowise Endpoint account.service.ts verify information disclosureEPSS 0.5%CVE-2025-3807MEDIUMzhenfeng13 My-BBS Endpoint UploadController.java upload unrestricted uploadEPSS 0.5%CVE-2025-53057MEDIUMVulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: SecuritEPSS 0.5%CVE-2020-10138HIGHAcronis Cyber Backup 12.5 and Cyber Protect 15 include an OpenSSL component that specifies an OPENSSLDIR variable as a subdirectory within CEPSS 0.5%CVE-2024-10765MEDIUMCodezips Online Institute Management System profile.php unrestricted uploadEPSS 0.5%CVE-2022-4814HIGHImproper Access Control in usememos/memosEPSS 0.5%CVE-2022-28754HIGHZoom On-Premise Deployments: Improper Access Control VulnerabilityEPSS 0.5%CVE-2024-10764MEDIUMCodezips Online Institute Management System save_user.php unrestricted uploadEPSS 0.5%CVE-2024-40480CRITICALA Broken Access Control vulnerability was found in /admin/update.php and /admin/dashboard.php in Kashipara Online Exam System v1.0, which alEPSS 0.5%CVE-2025-7879MEDIUMMetasoft 美特软件 MetaCRM mobileupload.jsp unrestricted uploadEPSS 0.5%CVE-2025-7877MEDIUMMetasoft 美特软件 MetaCRM sendfile.jsp unrestricted uploadEPSS 0.5%CVE-2024-25980MEDIUMMsa-24-0003: h5p attempts report did not respect activity group settingsEPSS 0.5%CVE-2023-29921MEDIUMPowerJob V4.3.1 is vulnerable to Incorrect Access Control via the create app interface.EPSS 0.5%CVE-2023-2429MEDIUMImproper Access Control in thorsten/phpmyfaqEPSS 0.5%CVE-2025-8025CRITICALImproper Access Control in Dinosoft Business Solutions' Dinosoft ERPEPSS 0.5%CVE-2026-76441CRITICALCisco Secure Email Gateway Security Hardening ReleaseEPSS 0.5%CVE-2026-16201MEDIUMzevorn rt-claw http_request net.c claw_net_post information disclosureEPSS 0.5%CVE-2025-11347MEDIUMcode-projects Student Crud Operation Add Student Page/Edit Student add.php move_uploaded_file unrestricted uploadEPSS 0.5%