Weaknesses of type CWE-284

7,088 results

Controle de acesso inadequado a recursos

A aplicação falha em validar ou impõe regras insuficientes para determinar quem pode acessar um recurso (arquivo, API, dados, funcionalidade). Um usuário não autorizado consegue contornar essas restrições e acessar o que não deveria, seja por falta de autenticação, autorização fraca ou lógica de controle de acesso bugada.

Example

Um sistema de gestão de RH permite que qualquer funcionário logado acesse `/api/salarios/{id}` substituindo o ID na URL. Sem verificar se o usuário é gestor ou RH, a API retorna dados salariais de qualquer pessoa da empresa. Um dev junior consegue ver quanto ganha o CTO.

How to mitigate

Implemente verificação explícita de permissões antes de qualquer acesso: confirme autenticação (quem é), autorização (o que pode fazer) e aplique o princípio do menor privilégio. Use listas de controle de acesso (ACL), roles bem definidos e sempre valide no backend, nunca confie em dados do cliente.

CVE-2024-1478MEDIUMMaintenance Mode <= 3.0.1 - Information ExposureEPSS 0.5%CVE-2025-26678HIGHWindows Defender Application Control Security Feature Bypass VulnerabilityEPSS 0.5%CVE-2026-67687HIGHInsecure Permissions vulnerability in ics-park v.2.0 allows a remote attacker to escalate privileges via the /system/role/save endpoint in REPSS 0.5%CVE-2024-50653HIGHCRMEB <=5.4.0 is vulnerable to Incorrect Access Control. Users can bypass the front-end restriction of only being able to claim coupons onceEPSS 0.5%CVE-2024-11054MEDIUMSourceCodester Simple Music Cloud Community System ajax.php unrestricted uploadEPSS 0.5%CVE-2023-1489HIGHLespeed WiseCleaner Wise System Monitor IoControlCode WiseHDInfo64.dll 0x9C402088 access controlEPSS 0.5%CVE-2025-63221CRITICALThe Axel Technology puma devices (firmware versions 0.8.5 to 1.0.3) are vulnerable to Broken Access Control due to missing authentication onEPSS 0.5%CVE-2025-0335MEDIUMcode-projects Online Bike Rental System Change Image unrestricted uploadEPSS 0.5%CVE-2025-46118MEDIUMAn issue was discovered in CommScope Ruckus Unleashed prior to 200.15.6.212.14 and 200.17.7.0.139 and in Ruckus ZoneDirector prior to 10.5.1EPSS 0.5%CVE-2024-12956MEDIUM1000 Projects Portfolio Management System MCA add_achievement_details.php unrestricted uploadEPSS 0.5%CVE-2025-27207MEDIUMAdobe Commerce | Improper Access Control (CWE-284)EPSS 0.5%CVE-2026-74979CRITICALMitigation bypass in the Add-ons Manager componentEPSS 0.5%CVE-2026-48904HIGHJoomla! Core - [20260514] - Privilege escalation through com_users webservice endpointsEPSS 0.5%CVE-2026-58439HIGHBranch Protection Bypass via PR Retargeting Preserves Stale `official` Approval FlagEPSS 0.5%CVE-2026-9349MEDIUMcalcom cal.diy Generic React API bookings-single-view.getServerSideProps.tsx getServerSideProps information disclosureEPSS 0.5%CVE-2026-5003MEDIUMPromtEngineer localGPT Web api_server.py handle_index information disclosureEPSS 0.5%CVE-2025-54116HIGHWindows MultiPoint Services Elevation of Privilege VulnerabilityEPSS 0.5%CVE-2025-4036MEDIUM201206030 Novel Chapter AuthorController.java updateBookChapter access controlEPSS 0.5%CVE-2025-3978MEDIUMdazhouda lecms user_set.htm information disclosureEPSS 0.5%CVE-2026-32768HIGHChall-Manager's invalid NetworkPolicy enables a malicious actor to pivot into another namespaceEPSS 0.5%