Falhas do tipo CWE-284

7.123 resultados

Controle de acesso inadequado a recursos

A aplicação falha em validar ou aplica incorretamente as restrições de acesso, permitindo que usuários não autorizados acessem dados ou funcionalidades que deveriam estar protegidas. É uma das fragilidades mais comuns em segurança: o código não verifica corretamente quem está pedindo acesso e simplesmente concede.

Exemplo

Um e-commerce que permite acessar o perfil de qualquer cliente substituindo o ID na URL (ex: /usuario/123 → /usuario/124), sem validar se o usuário autenticado é o dono daquele perfil. Um atacante consegue ver dados pessoais, histórico de compras e endereços de outras pessoas.

Como mitigar

Implemente verificações explícitas em cada acesso a recurso: autentique o usuário, identifique qual recurso ele quer acessar, e valide se as permissões dele cobrem aquele recurso específico. Use listas de controle de acesso (ACLs) ou papéis (RBAC/ABAC) consistentemente em toda a API ou aplicação, nunca deixando a segurança implícita.

CVE-2023-50341HIGHImproper Access Control affects DRYiCE MyXalyticsEPSS 0.4%CVE-2026-55118HIGHA malicious actor with access to the network,low privileges and under certain conditions could exploit an Improper Access Control vulnerabilEPSS 0.4%CVE-2026-1197LOWMineAdmin downloadById information disclosureEPSS 0.4%CVE-2025-59932HIGHFlagForgeCTF Unauthenticated Resource Modification/DeletionEPSS 0.4%CVE-2026-77681MEDIUMCodeAstro Online Job Portal update-profile.php unrestricted uploadEPSS 0.4%CVE-2026-90518MEDIUMPHPGurukul Bank Locker Management System sidebar.php access controlEPSS 0.4%CVE-2025-62721HIGHLinkAce: Authorization Bypass Allows Unauthorized Access to All Private Links, Lists, and TagsEPSS 0.4%CVE-2026-28922MEDIUMThis issue was addressed through improved state management. This issue is fixed in macOS Sequoia 15.7.7, macOS Sonoma 14.8.7, macOS Tahoe 26EPSS 0.4%CVE-2026-82679MEDIUMdiem-project diem Widget Editor dmWidgetContentBaseMediaForm.php unrestricted uploadEPSS 0.4%CVE-2026-86512MEDIUMjava-json-tools json-patch Copy Move Operations CopyOperation.java MoveOperation.apply access controlEPSS 0.4%CVE-2026-91005MEDIUMSourceCodester Online Faculty Clearance System Profile Picture Upload edit_picture.php move_uploaded_file unrestricted uploadEPSS 0.4%CVE-2026-93504MEDIUMSveltyCMS User Attribute Update Endpoint +server.ts access controlEPSS 0.4%CVE-2026-9579MEDIUMJeecgBoot SysUser userEdit user.getUsername access controlEPSS 0.4%CVE-2026-15188MEDIUMmanjurulhoque django-job-portal Employee Dashboard Endpoint views.py EditEmployeeProfileAPIView access controlEPSS 0.4%CVE-2026-85135MEDIUMILIAS MediaPool ZipAdapter.php uploadMultipleSubtitleFileObject unrestricted uploadEPSS 0.4%CVE-2026-88864CRITICALCapgo SSO Provider Authentication Bypass via PostgREST Direct WriteEPSS 0.4%CVE-2026-11344MEDIUMcode-projects Vehicle Management System New Driver Registration Form newdriver.php unrestricted uploadEPSS 0.4%CVE-2026-14698MEDIUMSourceCodester Syllabus-Aligned Learning Management and Examination System upload_files.php unrestricted uploadEPSS 0.4%CVE-2025-15423MEDIUMEmpireSoft EmpireCMS connect.php CheckSaveTranFiletype unrestricted uploadEPSS 0.4%CVE-2026-90857MEDIUMSourceCodester College Notes Gallery Management System Profile Upload userprofile.php unrestricted uploadEPSS 0.4%