Falhas do tipo CWE-284

7.095 resultados

Controle de acesso inadequado a recursos

A aplicação falha em validar ou aplica incorretamente as restrições de acesso, permitindo que usuários não autorizados acessem dados ou funcionalidades que deveriam estar protegidas. É uma das fragilidades mais comuns em segurança: o código não verifica corretamente quem está pedindo acesso e simplesmente concede.

Exemplo

Um e-commerce que permite acessar o perfil de qualquer cliente substituindo o ID na URL (ex: /usuario/123 → /usuario/124), sem validar se o usuário autenticado é o dono daquele perfil. Um atacante consegue ver dados pessoais, histórico de compras e endereços de outras pessoas.

Como mitigar

Implemente verificações explícitas em cada acesso a recurso: autentique o usuário, identifique qual recurso ele quer acessar, e valide se as permissões dele cobrem aquele recurso específico. Use listas de controle de acesso (ACLs) ou papéis (RBAC/ABAC) consistentemente em toda a API ou aplicação, nunca deixando a segurança implícita.

CVE-2026-90603MEDIUMAnil-matcha Open-Generative-AI S3 Upload upload-binary unrestricted uploadEPSS 0.5%CVE-2024-58330HIGHA missing authentication check in Bosch IP cameras of families CPP13 and CPP14 allows an unauthenticated attacker to retrieve video analyticEPSS 0.5%CVE-2026-47261HIGHWasmtime: WASI path_open(TRUNCATE) bypasses `FilePerms::WRITE` host restrictionEPSS 0.5%CVE-2026-18788MEDIUMTrippo ResponsiveFilemanager dialog.php unrestricted uploadEPSS 0.5%CVE-2024-20373MEDIUMCisco IOS and Cisco IOS XE SNMP Extended ACL Bypass VulnerabilityEPSS 0.5%CVE-2025-3410MEDIUMmymagicpower AIAS LocalStorageController.java unrestricted uploadEPSS 0.5%CVE-2024-23446MEDIUMKibana Broken Access Control issueEPSS 0.5%CVE-2025-3830MEDIUMkuangstudy KuangSimpleBBS QuestionController.java fileUpload unrestricted uploadEPSS 0.5%CVE-2026-15488MEDIUMhcr707305003 shiroiAdmin FileController.php upload unrestricted uploadEPSS 0.5%CVE-2023-51786CRITICALAn issue was discovered in Lustre versions 2.13.x, 2.14.x, and 2.15.x before 2.15.4, allows attackers to escalate privileges and obtain sensEPSS 0.5%CVE-2025-2280HIGHImproper access control in web extension restriction feature in Devolutions Server 2024.3.4.0 and earlier allows an authenticated user to EPSS 0.5%CVE-2025-6873MEDIUMSourceCodester Simple Company Website Users.php unrestricted uploadEPSS 0.5%CVE-2025-6872MEDIUMSourceCodester Simple Company Website SystemSettings.php unrestricted uploadEPSS 0.5%CVE-2024-29839HIGHBroken Access control on DESKTOP_EDIT_USER_GET_CARD in Evolution Controller allows unauthenticated attackers to retrieve card data values.EPSS 0.5%CVE-2026-18776CRITICALTrueBooker Appointment Booking < 1.2.7 - Unauthenticated Account Takeover via Multiple AJAX ActionsEPSS 0.5%CVE-2024-29840HIGHBroken Access control on DESKTOP_EDIT_USER_GET_PIN_FIELDS in Evolution Controller allows unauthenticated attackers to retrieve PIN field valuesEPSS 0.5%CVE-2024-29843HIGHBroken Access control on MOBILE_GET_USERS_LIST in Evolution Controller allows unauthenticated user enumerationEPSS 0.5%CVE-2026-66494HIGHJoomla Extension - joomshaper.com - Unauthenticated stored XSS in Shapes API endpoint SP Page Builder < 6.7.0EPSS 0.5%CVE-2026-67979CRITICALIncorrect access control in the Executive Services dynamic application start path component of NASA cFS v7.0.1 allows attackers to execute aEPSS 0.5%CVE-2024-29841HIGHBroken Access control on DESKTOP_EDIT_USER_GET_KEYS_FIELDS in Evolution Controller allows unauthenticated attackers to retrieve keys values EPSS 0.5%