Weaknesses of type CWE-284

7,088 results

Controle de acesso inadequado a recursos

A aplicação falha em validar ou impõe regras insuficientes para determinar quem pode acessar um recurso (arquivo, API, dados, funcionalidade). Um usuário não autorizado consegue contornar essas restrições e acessar o que não deveria, seja por falta de autenticação, autorização fraca ou lógica de controle de acesso bugada.

Example

Um sistema de gestão de RH permite que qualquer funcionário logado acesse `/api/salarios/{id}` substituindo o ID na URL. Sem verificar se o usuário é gestor ou RH, a API retorna dados salariais de qualquer pessoa da empresa. Um dev junior consegue ver quanto ganha o CTO.

How to mitigate

Implemente verificação explícita de permissões antes de qualquer acesso: confirme autenticação (quem é), autorização (o que pode fazer) e aplique o princípio do menor privilégio. Use listas de controle de acesso (ACL), roles bem definidos e sempre valide no backend, nunca confie em dados do cliente.

CVE-2026-86519MEDIUMcode-projects Student Crud Operation Backup File card_activation.sql information disclosureEPSS 0.5%CVE-2026-90565MEDIUMRizwan17 inventory-management-system dashboard.php access controlEPSS 0.5%CVE-2026-86302MEDIUMcode-projects Hospital Information System SQL Database Backup File his.sql information disclosureEPSS 0.5%CVE-2025-11347MEDIUMcode-projects Student Crud Operation Add Student Page/Edit Student add.php move_uploaded_file unrestricted uploadEPSS 0.5%CVE-2025-27724CRITICALA privilege escalation vulnerability exists in the login.php functionality of meddream MedDream PACS Premium 7.3.3.840. A specially crafted EPSS 0.5%CVE-2026-86239MEDIUMliufee FeehiCMS UEditor Widget UeditorAction.php init unrestricted uploadEPSS 0.5%CVE-2026-15530MEDIUMWuzhiCMS Attachment API index.php listimage information disclosureEPSS 0.5%CVE-2026-41920HIGHApache Traffic Server: SNI to Host header matching policy is not properly enforcedEPSS 0.5%CVE-2023-22448MEDIUMImproper access control for some Intel Unison software may allow a privileged user to potentially enable escalation of privilege via networkEPSS 0.5%CVE-2026-82548MEDIUMLinux Foundation Magma InitialUEMessage information disclosureEPSS 0.5%CVE-2026-86217MEDIUMcode-projects Hotel and Tourism Reservation in PHP Database Backup hotel_db%20(1).sql information disclosureEPSS 0.5%CVE-2025-9775MEDIUMRemoteClinic edit-my-profile.php unrestricted uploadEPSS 0.5%CVE-2026-82624MEDIUMcode-projects Simple Inventory System Database Backup File inventorymanagement.sql information disclosureEPSS 0.5%CVE-2026-6492MEDIUMarnobt78 Hotel Booking Management System Health Check Endpoint detailed information disclosureEPSS 0.5%CVE-2025-12378MEDIUMcode-projects Simple Food Ordering System addproduct.php unrestricted uploadEPSS 0.5%CVE-2025-12301MEDIUMcode-projects Simple Food Ordering System editproduct.php unrestricted uploadEPSS 0.5%CVE-2026-85517MEDIUMcode-projects Vehicle Management System SQL Database Backup File vehicle_management.sql information disclosureEPSS 0.5%CVE-2026-86179MEDIUMcode-projects Daily Expense Manager Database Backup exp_ak.sql information disclosureEPSS 0.5%CVE-2026-18974MEDIUMheshengtao super-agent-party execute_tool_manually Endpoint server.py get_file_content information disclosureEPSS 0.5%CVE-2026-13717HIGHRhoai maas: llm-d: maas/llm-d inference gateway: default allowedroutes.namespaces.from: all allows namespace users to hijack shared model-serving traffic (tokens, prompts, outputs)EPSS 0.5%