Fallos del tipo CWE-284

7967 resultados

Controle de acesso insuficiente ou ausente

A aplicação não valida corretamente quem pode acessar determinado recurso (arquivo, API, função, dados), permitindo que usuários não autorizados façam operações que deveriam estar bloqueadas. É um dos problemas mais comuns em segurança: sem autenticação e autorização robustas, qualquer um consegue fazer o que não deveria.

Ejemplo

Um admin panel acessível via /admin sem login real, ou uma API que retorna dados de qualquer usuário basta mudar um ID na URL sem verificar se você tem permissão. Outro caso: arquivo de configuração com credenciais exposto publicamente porque a aplicação não define permissões de leitura no servidor.

Cómo mitigar

Implemente autenticação forte (sessões, tokens JWT) e autorização em toda operação sensível — verifique explicitamente se o usuário logado tem permissão antes de retornar dados ou executar ações. Use listas de controle de acesso (ACL) ou Role-Based Access Control (RBAC), e nunca confie em IDs de usuário vindos do cliente sem validação server-side.

CVE-2021-22853MEDIUMSoar Cloud System Co., Ltd. HR Portal - Broken Access ControlEPSS 1.0%CVE-2025-23048CRITICALApache HTTP Server: mod_ssl access control bypass with session resumptionEPSS 1.0%CVE-2022-20918HIGHA vulnerability in the Simple Network Management Protocol (SNMP) access controls for Cisco FirePOWER Software for Adaptive Security AppliancEPSS 1.0%CVE-2024-22187CRITICALA write-what-where vulnerability exists in the Programming Software Connection Remote Memory Diagnostics functionality of AutomationDirect PEPSS 1.0%CVE-2022-38184HIGHThere is an improper access control vulnerability in Portal for ArcGIS versions 10.8.1EPSS 1.0%CVE-2020-8121—A bug in Nextcloud Server 14.0.4 could expose more data in reshared link shares than intended by the sharer.EPSS 1.0%CVE-2023-21968LOWVulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Libraries). Supported versionsEPSS 1.0%CVE-2017-15891—Improper access control vulnerability in SYNO.Cal.EventBase in Synology Calendar before 2.0.1-0242 allows remote authenticated users to modiEPSS 1.0%CVE-2020-8182—Improper access control in Nextcloud Deck 0.8.0 allowed an attacker to reshare boards shared with them with more permissions than they had tEPSS 1.0%CVE-2024-20926MEDIUMVulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: ScriptiEPSS 1.0%CVE-2022-22183HIGHJunos OS Evolved: A remote attacker may cause a CPU Denial of Service by sending genuine traffic to a device on a specific IPv4 port.EPSS 1.0%CVE-2019-6193HIGHAn information disclosure vulnerability was reported in Lenovo XClarity Administrator (LXCA) versions prior to 2.6.6 that could allow unauthEPSS 1.0%CVE-2026-102132HIGHKiteworks Core Privilege Escalation through Improper Access ControlEPSS 1.0%CVE-2020-2504MEDIUMAbsolute path traversal vulnerability in QESEPSS 1.0%CVE-2024-38220CRITICALAzure Stack Hub Elevation of Privilege VulnerabilityEPSS 1.0%CVE-2019-11892HIGHImproper access control in the JSON-RPC interface of the Bosch Smart Home Controller (SHC)EPSS 1.0%CVE-2026-5311MEDIUMD-Link DNS-1550-04 file_center.cgi Webdav_Access_List access controlEPSS 1.0%CVE-2019-10138HIGHA flaw was discovered in the python-novajoin plugin, all versions up to, excluding 1.1.1, for Red Hat OpenStack Platform. The novajoin API lEPSS 1.0%CVE-2021-24845—Improved Include Page <= 1.2 - Contributor+ Arbitrary Posts/Pages AccessEPSS 1.0%CVE-2025-2548MEDIUMD-Link DIR-618/DIR-605L formSetDomainFilter access controlEPSS 1.0%