Falhas do tipo CWE-284

7.146 resultados

Controle de acesso inadequado a recursos

A aplicação falha em validar ou aplica incorretamente as restrições de acesso, permitindo que usuários não autorizados acessem dados ou funcionalidades que deveriam estar protegidas. É uma das fragilidades mais comuns em segurança: o código não verifica corretamente quem está pedindo acesso e simplesmente concede.

Exemplo

Um e-commerce que permite acessar o perfil de qualquer cliente substituindo o ID na URL (ex: /usuario/123 → /usuario/124), sem validar se o usuário autenticado é o dono daquele perfil. Um atacante consegue ver dados pessoais, histórico de compras e endereços de outras pessoas.

Como mitigar

Implemente verificações explícitas em cada acesso a recurso: autentique o usuário, identifique qual recurso ele quer acessar, e valide se as permissões dele cobrem aquele recurso específico. Use listas de controle de acesso (ACLs) ou papéis (RBAC/ABAC) consistentemente em toda a API ou aplicação, nunca deixando a segurança implícita.

CVE-2026-14829HIGHCheckimate <= 1.0.13 - Unauthenticated License Deactivation via Hardcoded SecretEPSS 0.3%CVE-2025-8859MEDIUMcode-projects eBlog Site File Upload save-slider.php unrestricted uploadEPSS 0.3%CVE-2026-0844HIGHSimple User Registration <= 6.7 - Authenticated (Subscriber+) Privilege Escalation via profile_save_fieldEPSS 0.3%CVE-2025-4281MEDIUMShenzhen Sixun Software Sixun Shanghui Group Business Management System LoadData information disclosureEPSS 0.3%CVE-2026-46936MEDIUMVulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: DDL). Supported versions that are affected areEPSS 0.3%CVE-2025-9841MEDIUMcode-projects Mobile Shop Management System AddNewProduct.php unrestricted uploadEPSS 0.3%CVE-2026-60189MEDIUMVulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Replication). Supported versions that are affeEPSS 0.3%CVE-2026-60188MEDIUMVulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Replication). Supported versions that are affeEPSS 0.3%CVE-2025-66911MEDIUMTurms IM Server v0.10.0-SNAPSHOT and earlier contains a broken access control vulnerability in the user online status query functionality. TEPSS 0.3%CVE-2024-4263MEDIUMImproper Access Control in mlflow/mlflowEPSS 0.3%CVE-2026-13171HIGHEventin < 4.1.20 - Unauthenticated Account Creation via Waiting List EndpointEPSS 0.3%CVE-2026-13897HIGHInsufficient policy enforcement in Chromecast in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to perform privilege escalatEPSS 0.3%CVE-2023-3096MEDIUMKylinSoft kylin-software-properties changedSource access controlEPSS 0.3%CVE-2026-41270HIGHFlowise: SSRF Protection Bypass via Unprotected Built-in HTTP Modules in Custom Function SandboxEPSS 0.3%CVE-2024-13693MEDIUMEnfold <= 6.0.9 - Missing Authorization to Sensitive Information Disclosure in avia-export-class.phpEPSS 0.3%CVE-2026-56050MEDIUMWordPress PPOM for WooCommerce plugin <= 33.0.18 - Broken Access Control vulnerabilityEPSS 0.3%CVE-2025-9139MEDIUMScada-LTS WatchListDwr.init.dwr information disclosureEPSS 0.3%CVE-2026-70691HIGHVulnerability in the Oracle Agile Engineering Data Management product of Oracle Supply Chain (component: Engineering Communication InterfaceEPSS 0.3%CVE-2023-47294HIGHAn issue in NCR Terminal Handler v1.5.1 allows low-level privileged authenticated attackers to arbitrarily deactivate, lock, and delete userEPSS 0.3%CVE-2024-1888MEDIUMExisting server guests invited to the team by members without "invite_guest" permissionEPSS 0.3%