Falhas do tipo CWE-284

7.123 resultados

Controle de acesso inadequado a recursos

A aplicação falha em validar ou aplica incorretamente as restrições de acesso, permitindo que usuários não autorizados acessem dados ou funcionalidades que deveriam estar protegidas. É uma das fragilidades mais comuns em segurança: o código não verifica corretamente quem está pedindo acesso e simplesmente concede.

Exemplo

Um e-commerce que permite acessar o perfil de qualquer cliente substituindo o ID na URL (ex: /usuario/123 → /usuario/124), sem validar se o usuário autenticado é o dono daquele perfil. Um atacante consegue ver dados pessoais, histórico de compras e endereços de outras pessoas.

Como mitigar

Implemente verificações explícitas em cada acesso a recurso: autentique o usuário, identifique qual recurso ele quer acessar, e valide se as permissões dele cobrem aquele recurso específico. Use listas de controle de acesso (ACLs) ou papéis (RBAC/ABAC) consistentemente em toda a API ou aplicação, nunca deixando a segurança implícita.

CVE-2026-28922MEDIUMThis issue was addressed through improved state management. This issue is fixed in macOS Sequoia 15.7.7, macOS Sonoma 14.8.7, macOS Tahoe 26EPSS 0.4%CVE-2026-86512MEDIUMjava-json-tools json-patch Copy Move Operations CopyOperation.java MoveOperation.apply access controlEPSS 0.4%CVE-2026-14776MEDIUMSourceCodester Onlne Examination & Learning Management System Filename Extension upload_files.php pathinfo unrestricted uploadEPSS 0.4%CVE-2026-82679MEDIUMdiem-project diem Widget Editor dmWidgetContentBaseMediaForm.php unrestricted uploadEPSS 0.4%CVE-2025-64673HIGHWindows Storage VSP Driver Elevation of Privilege VulnerabilityEPSS 0.4%CVE-2025-15423MEDIUMEmpireSoft EmpireCMS connect.php CheckSaveTranFiletype unrestricted uploadEPSS 0.4%CVE-2025-62474HIGHWindows Remote Access Connection Manager Elevation of Privilege VulnerabilityEPSS 0.4%CVE-2026-11344MEDIUMcode-projects Vehicle Management System New Driver Registration Form newdriver.php unrestricted uploadEPSS 0.4%CVE-2026-9579MEDIUMJeecgBoot SysUser userEdit user.getUsername access controlEPSS 0.4%CVE-2026-77681MEDIUMCodeAstro Online Job Portal update-profile.php unrestricted uploadEPSS 0.4%CVE-2026-15188MEDIUMmanjurulhoque django-job-portal Employee Dashboard Endpoint views.py EditEmployeeProfileAPIView access controlEPSS 0.4%CVE-2026-61700LOWMariaDB Connector/J does not enforce allowLocalInfile=false on server-initiated LOCAL INFILE requestsEPSS 0.4%CVE-2025-9973MEDIUMAuthorization Bypass via Adaptive Authentication in WSO2 Identity Server Allows Cross-Organization Account TakeoverEPSS 0.4%CVE-2026-88864CRITICALCapgo SSO Provider Authentication Bypass via PostgREST Direct WriteEPSS 0.4%CVE-2026-14698MEDIUMSourceCodester Syllabus-Aligned Learning Management and Examination System upload_files.php unrestricted uploadEPSS 0.4%CVE-2026-90857MEDIUMSourceCodester College Notes Gallery Management System Profile Upload userprofile.php unrestricted uploadEPSS 0.4%CVE-2026-83010HIGHVulnerability in the Oracle WebCenter Enterprise Capture product of Oracle Fusion Middleware (component: Client Bundle). Supported versionsEPSS 0.4%CVE-2026-23495MEDIUMPimcore's Admin Classic Bundle is Missing Function Level Authorization on "Predefined Properties" ListingEPSS 0.4%CVE-2025-37137MEDIUMAuthenticated Arbitrary File Deletion Vulnerabilities in AOS-8 Controller/Mobility Conductor Command Line Interface (CLI)EPSS 0.4%CVE-2025-10085MEDIUMSourceCodester Pet Grooming Management Software manage_website.php unrestricted uploadEPSS 0.4%