Falhas do tipo CWE-284

7.140 resultados

Controle de acesso inadequado a recursos

A aplicação falha em validar ou aplica incorretamente as restrições de acesso, permitindo que usuários não autorizados acessem dados ou funcionalidades que deveriam estar protegidas. É uma das fragilidades mais comuns em segurança: o código não verifica corretamente quem está pedindo acesso e simplesmente concede.

Exemplo

Um e-commerce que permite acessar o perfil de qualquer cliente substituindo o ID na URL (ex: /usuario/123 → /usuario/124), sem validar se o usuário autenticado é o dono daquele perfil. Um atacante consegue ver dados pessoais, histórico de compras e endereços de outras pessoas.

Como mitigar

Implemente verificações explícitas em cada acesso a recurso: autentique o usuário, identifique qual recurso ele quer acessar, e valide se as permissões dele cobrem aquele recurso específico. Use listas de controle de acesso (ACLs) ou papéis (RBAC/ABAC) consistentemente em toda a API ou aplicação, nunca deixando a segurança implícita.

CVE-2026-7043MEDIUMGreenCMS index.php pluginAddLocal unrestricted uploadEPSS 0.3%CVE-2026-41728HIGHSpring Data REST JSON Patch bypasses Jackson read-only property protection on nested objects and collectionsEPSS 0.3%CVE-2022-31231MEDIUMDell ECS, versions 3.5 and 3.6, contain an Improper Access Control in the Identity and Access Management (IAM) module. A remote unauthenticaEPSS 0.3%CVE-2026-90969MEDIUMImproper access control in the vault entry listing feature in Devolutions Server 2026.2.16 and earlier allows an authenticated user lacking EPSS 0.3%CVE-2025-43285MEDIUMA permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15.7, macOS Sonoma 14.8, macOS Tahoe 26EPSS 0.3%CVE-2026-54765MEDIUMTraefik: Gateway HTTPRoute backendRef filters can leak backend context across routes sharing a Service:portEPSS 0.3%CVE-2024-13854MEDIUMEducation Addon for Elementor <= 1.3.1 - Authenticated (Contributor+) Insecure Direct Object Reference via naedu_elementor_template ShortcodeEPSS 0.3%CVE-2024-13514MEDIUMB Slider- Gutenberg Slider Block for WP <= 1.1.23 - Authenticated (Contributor+) Private Post Disclosure via bsb-slider ShortcodeEPSS 0.3%CVE-2024-36441MEDIUMSwissphone DiCal-RED 4009 devices allow an unauthenticated attacker use a port-2101 TCP connection to gain access to operation messages thatEPSS 0.3%CVE-2021-3987MEDIUMImproper Access Control in janeczku/calibre-webEPSS 0.3%CVE-2024-9157HIGHPrivilege Escalation Vulnerability in CxUIUSvc serviceEPSS 0.3%CVE-2022-36851LOWImproper access control vulnerability in Samsung pass prior to version 4.0.03.1 allow physical attackers to access data of Samsung pass on aEPSS 0.3%CVE-2026-93604MEDIUMvm2 3.11.8 Sandbox Escape via crypto.setFipsEPSS 0.3%CVE-2025-9099MEDIUMAcrel Environmental Monitoring Cloud Platform UploadNewsImg unrestricted uploadEPSS 0.3%CVE-2026-48955MEDIUMJoomla! Core - [20260709] - Incorrect Access Control in com_workflowEPSS 0.3%CVE-2026-49198HIGHPredator Connect W6x: MQTT Broker Access ControlEPSS 0.3%CVE-2025-43204HIGHThis issue was addressed by removing the vulnerable code. This issue is fixed in macOS Tahoe 26. An app may be able to break out of its sandEPSS 0.3%CVE-2024-8071MEDIUMSystem Role with edit access to permissions can elevate themselves to system adminEPSS 0.3%CVE-2025-61114HIGH2nd Line Android App version v1.2.92 and before (package name com.mysecondline.app), developed by AutoBizLine, Inc., contains an improper acEPSS 0.3%CVE-2025-41258HIGHLibreChat RAG API Authentication BypassEPSS 0.3%