Falhas do tipo CWE-284

7.111 resultados

Controle de acesso inadequado a recursos

A aplicação falha em validar ou aplica incorretamente as restrições de acesso, permitindo que usuários não autorizados acessem dados ou funcionalidades que deveriam estar protegidas. É uma das fragilidades mais comuns em segurança: o código não verifica corretamente quem está pedindo acesso e simplesmente concede.

Exemplo

Um e-commerce que permite acessar o perfil de qualquer cliente substituindo o ID na URL (ex: /usuario/123 → /usuario/124), sem validar se o usuário autenticado é o dono daquele perfil. Um atacante consegue ver dados pessoais, histórico de compras e endereços de outras pessoas.

Como mitigar

Implemente verificações explícitas em cada acesso a recurso: autentique o usuário, identifique qual recurso ele quer acessar, e valide se as permissões dele cobrem aquele recurso específico. Use listas de controle de acesso (ACLs) ou papéis (RBAC/ABAC) consistentemente em toda a API ou aplicação, nunca deixando a segurança implícita.

CVE-2026-71807MEDIUMIn RuoYi-Cloud-Plus <= 2.6.2 in the ruoyi-workflow module, multiple core task APIs in FlwTaskController lack permission annotations, and theEPSS 0.4%CVE-2024-28969MEDIUMDell SCG, versions prior to 5.24.00.00, contain an Improper Access Control vulnerability in the SCG exposed for an internal update REST API EPSS 0.4%CVE-2018-4844—A vulnerability has been identified in SIMATIC WinCC OA UI for Android (All versions < V3.15.10), SIMATIC WinCC OA UI for iOS (All versions EPSS 0.4%CVE-2026-20304CRITICALCisco Catalyst SD-WAN Security Hardening Release - Access Control VulnerabilitiesEPSS 0.4%CVE-2024-0369MEDIUMBulk Edit Post Titles <= 5.0.0 - Missing Authorization via bulkUpdatePostTitlesEPSS 0.4%CVE-2026-20150HIGHCisco RoomOS Security Hardening Release - Access Control VulnerabilitiesEPSS 0.4%CVE-2025-7755MEDIUMcode-projects Online Ordering System edit_product.php unrestricted uploadEPSS 0.4%CVE-2026-87233HIGHVulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security). The supported version that is EPSS 0.4%CVE-2024-33647MEDIUMA vulnerability has been identified in Polarion ALM (All versions < V2404.0). The Apache Lucene based query engine in the affected applicatiEPSS 0.4%CVE-2024-39701MEDIUMDirectus Incorrectly handles _in` filterEPSS 0.4%CVE-2026-48957MEDIUMJoomla! Core - [20260711] - Incorrect Access Control in com_privacy webservice endpointsEPSS 0.4%CVE-2026-48948MEDIUMJoomla! Core - [20260702] - Incorrect Access Control in com_contact vcf downloadEPSS 0.4%CVE-2025-55469CRITICALIncorrect access control in youlai-boot v2.21.1 allows attackers to escalate privileges and access the Administrator backend.EPSS 0.4%CVE-2025-8256MEDIUMcode-projects Online Ordering System product.php unrestricted uploadEPSS 0.4%CVE-2024-57157CRITICALIncorrect access control in Jantent v1.1 allows attackers to bypass authentication and access sensitive APIs without a token.EPSS 0.4%CVE-2021-24752—Multiple Plugins from CatchThemes - Unauthorised Plugin's Setting ChangeEPSS 0.4%CVE-2026-30994HIGHIncorrect access control in the config.php component of Slah v1.5.0 and below allows unauthenticated attackers to access sensitive informatiEPSS 0.4%CVE-2025-23083HIGHWith the aid of the diagnostics_channel utility, an event can be hooked into whenever a worker thread is created. This is not limited only tEPSS 0.4%CVE-2025-11398MEDIUMSourceCodester Hotel and Lodge Management System Profile profile.php unrestricted uploadEPSS 0.4%CVE-2024-57154CRITICALIncorrect access control in dts-shop v0.0.1-SNAPSHOT allows attackers to bypass authentication via sending a crafted payload to /admin/auth/EPSS 0.4%