Falhas do tipo CWE-284

7.111 resultados

Controle de acesso inadequado a recursos

A aplicação falha em validar ou aplica incorretamente as restrições de acesso, permitindo que usuários não autorizados acessem dados ou funcionalidades que deveriam estar protegidas. É uma das fragilidades mais comuns em segurança: o código não verifica corretamente quem está pedindo acesso e simplesmente concede.

Exemplo

Um e-commerce que permite acessar o perfil de qualquer cliente substituindo o ID na URL (ex: /usuario/123 → /usuario/124), sem validar se o usuário autenticado é o dono daquele perfil. Um atacante consegue ver dados pessoais, histórico de compras e endereços de outras pessoas.

Como mitigar

Implemente verificações explícitas em cada acesso a recurso: autentique o usuário, identifique qual recurso ele quer acessar, e valide se as permissões dele cobrem aquele recurso específico. Use listas de controle de acesso (ACLs) ou papéis (RBAC/ABAC) consistentemente em toda a API ou aplicação, nunca deixando a segurança implícita.

CVE-2024-57154CRITICALIncorrect access control in dts-shop v0.0.1-SNAPSHOT allows attackers to bypass authentication via sending a crafted payload to /admin/auth/EPSS 0.4%CVE-2026-30244HIGHPlane: Unauthenticated Workspace Member Information DisclosureEPSS 0.4%CVE-2026-1423MEDIUMcode-projects Online Examination System admin_pic.php unrestricted uploadEPSS 0.4%CVE-2025-8256MEDIUMcode-projects Online Ordering System product.php unrestricted uploadEPSS 0.4%CVE-2026-48899MEDIUMJoomla! Core - [20260515] - Incorrect Access Control in sample data pluginsEPSS 0.4%CVE-2026-45080MEDIUMKlaw: Improper Access Control Allows Disclosure of Password HashEPSS 0.4%CVE-2026-3668LOWFreedom Factory dGEN1 org.ethosmobile.webpwaemul AndroidEthereum access controlEPSS 0.4%CVE-2026-43821MEDIUMAn access issue was addressed with improved access restrictions. This issue is fixed in Safari 26.6, iOS 18.7.10 and iPadOS 18.7.10, iOS 26.EPSS 0.4%CVE-2024-22807MEDIUMAn issue in Tormach xsTECH CNC Router, PathPilot Controller v2.9.6 allows attackers to erase a critical sector of the flash memory, causing EPSS 0.4%CVE-2025-8795MEDIUMLitmusChaos Litmus login access controlEPSS 0.4%CVE-2026-83181HIGHVulnerability in the Siebel CRM Development product of Oracle Siebel CRM (component: Workspaces). Supported versions that are affected are EPSS 0.4%CVE-2025-70985CRITICALIncorrect access control in the update function of RuoYi v4.8.2 allows unauthorized attackers to arbitrarily modify data outside of their scEPSS 0.4%CVE-2024-21741CRITICALGigaDevice GD32E103C8T6 devices have Incorrect Access Control.EPSS 0.4%CVE-2026-65760CRITICALJoomla Extension - joomshaper.com - cross-customer order and personal information disclosure in Easy Store extension 1.0.0-2.0.1EPSS 0.4%CVE-2026-91164MEDIUMWarpgate: API tokens bypass the user's allowed_ip_ranges restrictionEPSS 0.4%CVE-2025-7477MEDIUMcode-projects Simple Car Rental System add_cars.php unrestricted uploadEPSS 0.4%CVE-2026-83019HIGHVulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: SQR). Supported versions that are affected EPSS 0.4%CVE-2026-54010HIGHOpen WebUI: Forged chat-file link allows cross-user file read and deletionEPSS 0.4%CVE-2026-46485HIGHDash: Users can write to config despire permissions (OIDC tested)EPSS 0.4%CVE-2026-7041MEDIUM666ghj MiroFish Werkzeug Debugger PIN console information disclosureEPSS 0.4%