Falhas do tipo CWE-284

7.101 resultados

Controle de acesso inadequado a recursos

A aplicação falha em validar ou aplica incorretamente as restrições de acesso, permitindo que usuários não autorizados acessem dados ou funcionalidades que deveriam estar protegidas. É uma das fragilidades mais comuns em segurança: o código não verifica corretamente quem está pedindo acesso e simplesmente concede.

Exemplo

Um e-commerce que permite acessar o perfil de qualquer cliente substituindo o ID na URL (ex: /usuario/123 → /usuario/124), sem validar se o usuário autenticado é o dono daquele perfil. Um atacante consegue ver dados pessoais, histórico de compras e endereços de outras pessoas.

Como mitigar

Implemente verificações explícitas em cada acesso a recurso: autentique o usuário, identifique qual recurso ele quer acessar, e valide se as permissões dele cobrem aquele recurso específico. Use listas de controle de acesso (ACLs) ou papéis (RBAC/ABAC) consistentemente em toda a API ou aplicação, nunca deixando a segurança implícita.

CVE-2025-21340MEDIUMWindows Virtualization-Based Security (VBS) Security Feature Bypass VulnerabilityEPSS 0.5%CVE-2026-65613MEDIUMApache CloudStack: Webhook Deliveries Incorrect AccessEPSS 0.5%CVE-2024-1492MEDIUMWPify Woo Czech <= 4.0.8 - Missing AuthorizationEPSS 0.5%CVE-2025-5059MEDIUMCampcodes Online Shopping Portal edit-subcategory.php unrestricted uploadEPSS 0.5%CVE-2026-24690HIGHGitea pull-request branch updates use insufficient permission checksEPSS 0.5%CVE-2026-27660HIGHGitea draft releases use insufficient permission checksEPSS 0.5%CVE-2025-32726MEDIUMVisual Studio Code Elevation of Privilege VulnerabilityEPSS 0.5%CVE-2025-39247HIGHThere is an Access Control Vulnerability in some HikCentral Professional versions. This could allow an unauthenticated user to obtain the adEPSS 0.5%CVE-2025-61777CRITICALFlagForge Allows Unauthenticated Badge Template API AccessEPSS 0.5%CVE-2025-46608CRITICALDell Data Lakehouse, versions prior to 1.6.0.0, contain(s) an Improper Access Control vulnerability. A high privileged attacker with remote EPSS 0.5%CVE-2025-4926MEDIUMPHPGurukul Car Rental Project post-avehical.php unrestricted uploadEPSS 0.5%CVE-2022-1959MEDIUMAppLock version 7.9.29 allows an attacker with physical access to the device to bypass biometric authentication. This is possible because thEPSS 0.5%CVE-2020-3231MEDIUMCisco IOS Software for Catalyst 2960-L Series Switches and Catalyst CDB-8P Switches 802.1X Authentication Bypass VulnerabilityEPSS 0.5%CVE-2025-7547MEDIUMCampcodes Online Movie Theater Seat Reservation System admin_class.php save_movie unrestricted uploadEPSS 0.5%CVE-2025-2705MEDIUMDigiwin ERP FileUploadApi.ashx DoWebUpload unrestricted uploadEPSS 0.4%CVE-2024-20263MEDIUMA vulnerability with the access control list (ACL) management within a stacked switch configuration of Cisco Business 250 Series Smart SwitcEPSS 0.4%CVE-2021-24801—WP Survey Plus <= 1.0 - Subscriber+ AJAX CallsEPSS 0.4%CVE-2024-1092MEDIUMRSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator <= 4.4.1 - Missing AuthorizationEPSS 0.4%CVE-2023-36820MEDIUMmicronaut security has invalid IdTokenClaimsValidator logic on audEPSS 0.4%CVE-2018-17908—WebAccess Versions 8.3.2 and prior. During installation, the application installer disables user access control and does not re-enable it afEPSS 0.4%