Falhas do tipo CWE-284

7.140 resultados

Controle de acesso inadequado a recursos

A aplicação falha em validar ou aplica incorretamente as restrições de acesso, permitindo que usuários não autorizados acessem dados ou funcionalidades que deveriam estar protegidas. É uma das fragilidades mais comuns em segurança: o código não verifica corretamente quem está pedindo acesso e simplesmente concede.

Exemplo

Um e-commerce que permite acessar o perfil de qualquer cliente substituindo o ID na URL (ex: /usuario/123 → /usuario/124), sem validar se o usuário autenticado é o dono daquele perfil. Um atacante consegue ver dados pessoais, histórico de compras e endereços de outras pessoas.

Como mitigar

Implemente verificações explícitas em cada acesso a recurso: autentique o usuário, identifique qual recurso ele quer acessar, e valide se as permissões dele cobrem aquele recurso específico. Use listas de controle de acesso (ACLs) ou papéis (RBAC/ABAC) consistentemente em toda a API ou aplicação, nunca deixando a segurança implícita.

CVE-2024-23681HIGHArtemis Java Test Sandbox Libary Load EscapeEPSS 0.3%CVE-2025-41258HIGHLibreChat RAG API Authentication BypassEPSS 0.3%CVE-2025-61114HIGH2nd Line Android App version v1.2.92 and before (package name com.mysecondline.app), developed by AutoBizLine, Inc., contains an improper acEPSS 0.3%CVE-2025-0743MEDIUMImproper Access Control vulnerability in EmbedAIEPSS 0.3%CVE-2025-61234HIGHIncorrect access control on Dataphone A920 v2025.07.161103 exposes a service on port 8888 by default on the local network without authenticaEPSS 0.3%CVE-2022-43679MEDIUMThe Docker image of ownCloud Server through 10.11 contains a misconfiguration that renders the trusted_domains config useless. This could beEPSS 0.3%CVE-2024-8071MEDIUMSystem Role with edit access to permissions can elevate themselves to system adminEPSS 0.3%CVE-2026-30926HIGHSiYuan Note publish service authorization bypass allows low-privilege users to modify notebook contentEPSS 0.3%CVE-2023-52164MEDIUMaccess_device.cgi on Digiever DS-2105 Pro 3.1.0.71-11 devices allows arbitrary file read. NOTE: This vulnerability only affects products thaEPSS 0.3%CVE-2025-61116HIGHAdForest - Classified Android App version 4.0.12 (package name scriptsbundle.adforest), developed by Muhammad Jawad Arshad, contains an imprEPSS 0.3%CVE-2024-9503MEDIUMMaintenance & Coming Soon Redirect Animation <= 2.1.3 - Missing Authorization to Settings UpdateEPSS 0.3%CVE-2026-33393MEDIUMDiscourse fixes loose hostname matching in spam host allowlistEPSS 0.3%CVE-2026-87891MEDIUMRox Appointment Booking < 1.2.0 - Unauthenticated Holiday Schedule Modification via REST APIEPSS 0.3%CVE-2026-92099MEDIUMWPGraphQL Smart Cache < 2.3.2 - Unauthenticated Persisted Query Registration and Alias SquattingEPSS 0.3%CVE-2026-14816MEDIUMThe GDPR Framework < 2.4.0 - Unauthenticated Consent Record Forgery and Do Not Sell Requests SpamEPSS 0.3%CVE-2025-8526MEDIUMExrick xboot UploadController.java upload unrestricted uploadEPSS 0.3%CVE-2026-71574HIGHJoomla! Core - [20260803] - Inconsistent ACL checks for mutating webservice endpoints in Joomla 4.0.0-5.4.7, 6.0.0-6.1.2EPSS 0.3%CVE-2026-60671HIGHVulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: BI Platform Security). SupportEPSS 0.3%CVE-2026-62578MEDIUMVulnerability in the Oracle Hyperion Calculation Manager product of Oracle Hyperion (component: Security). The supported version that is aEPSS 0.3%CVE-2024-0437MEDIUMPassword Protected – Ultimate Plugin to Password Protect Your WordPress Content with Ease <= 2.6.6 - Missing Authorization to Sensitive Information ExposureEPSS 0.3%