Fallos del tipo CWE-284

7074 resultados

Controle de acesso insuficiente ou ausente

A aplicação não valida corretamente quem pode acessar determinado recurso (arquivo, API, função, dados), permitindo que usuários não autorizados façam operações que deveriam estar bloqueadas. É um dos problemas mais comuns em segurança: sem autenticação e autorização robustas, qualquer um consegue fazer o que não deveria.

Ejemplo

Um admin panel acessível via /admin sem login real, ou uma API que retorna dados de qualquer usuário basta mudar um ID na URL sem verificar se você tem permissão. Outro caso: arquivo de configuração com credenciais exposto publicamente porque a aplicação não define permissões de leitura no servidor.

Cómo mitigar

Implemente autenticação forte (sessões, tokens JWT) e autorização em toda operação sensível — verifique explicitamente se o usuário logado tem permissão antes de retornar dados ou executar ações. Use listas de controle de acesso (ACL) ou Role-Based Access Control (RBAC), e nunca confie em IDs de usuário vindos do cliente sem validação server-side.

CVE-2026-3025MEDIUMShuoRen Smart Heating Integrated Management Platform ExampleNodeService.asmx unrestricted uploadEPSS 0.7%CVE-2023-6758MEDIUMThecosy IceCMS API PlanetCommentList access controlEPSS 0.7%CVE-2022-41155MEDIUMWordPress iQ Block Country plugin <= 1.2.18 - Block BYPASS vulnerabilityEPSS 0.7%CVE-2022-28761MEDIUMZoom On-Premise Deployments: Improper Access ControlEPSS 0.7%CVE-2023-3018MEDIUMSourceCodester Lost and Found Information System access controlEPSS 0.7%CVE-2023-25150MEDIUMDocument content of files can be obtained through Collabora for files of other usersEPSS 0.7%CVE-2021-28504HIGHOn Arista Strata family products which have “TCAM profile” feature enabled when Port IPv4 access-list has a rule which matches on “vxlan” as protocol then that rule and subsequent rules ( rules declared after it in ACL ) do not match on IP protocol fi ...EPSS 0.7%CVE-2026-26418HIGHMissing authentication and authorization in the web API of Tata Consultancy Services Cognix Recon Client v3.0 allows remote attackers to accEPSS 0.7%CVE-2011-1762—A flaw exists in Wordpress related to the 'wp-admin/press-this.php 'script improperly checking user permissions when publishing posts. This EPSS 0.7%CVE-2026-48204CRITICALApache Camel: Camel-MongoDB-GridFS: The gridfs.* control headers used non-Camel-prefixed names that bypass the HTTP header filter, allowing an HTTP client to switch the GridFS operation - including destructive file deletion - in the default configurationEPSS 0.7%CVE-2023-41322MEDIUMPrivilege Escalation from technician to super-admin in GLPIEPSS 0.7%CVE-2024-33898CRITICALAxiros AXESS Auto Configuration Server (ACS) 4.x and 5.0.0 is affected by an Incorrect Access Control vulnerability. An authorization bypassEPSS 0.7%CVE-2026-45177CRITICALIdira Secrets Manager SaaS Edge: Authentication Bypass of an internal validation mechanismEPSS 0.7%CVE-2022-45778CRITICALhttps://www.hillstonenet.com.cn/ Hillstone Firewall SG-6000 <= 5.0.4.0 is vulnerable to Incorrect Access Control. There is a permission bypaEPSS 0.7%CVE-2026-2894MEDIUMfunadmin forget.html getMember information disclosureEPSS 0.7%CVE-2023-25161LOWNextcloud Server's missing rate limiting on password reset functionality allows sending lots of emailsEPSS 0.7%CVE-2022-1958MEDIUMFileCloud NTFS access controlEPSS 0.7%CVE-2019-15998MEDIUMCisco IOS XR Software NETCONF Over Secure Shell ACL Bypass VulnerabilityEPSS 0.7%CVE-2024-56883HIGHSage DPW before 2024_12_001 is vulnerable to Incorrect Access Control. The implemented role-based access controls are not always enforced onEPSS 0.7%CVE-2020-15102MEDIUMImproper access control on dashboard form in PrestaShopEPSS 0.7%