Falhas do tipo CWE-284

7.169 resultados

Controle de acesso inadequado a recursos

A aplicação falha em validar ou aplica incorretamente as restrições de acesso, permitindo que usuários não autorizados acessem dados ou funcionalidades que deveriam estar protegidas. É uma das fragilidades mais comuns em segurança: o código não verifica corretamente quem está pedindo acesso e simplesmente concede.

Exemplo

Um e-commerce que permite acessar o perfil de qualquer cliente substituindo o ID na URL (ex: /usuario/123 → /usuario/124), sem validar se o usuário autenticado é o dono daquele perfil. Um atacante consegue ver dados pessoais, histórico de compras e endereços de outras pessoas.

Como mitigar

Implemente verificações explícitas em cada acesso a recurso: autentique o usuário, identifique qual recurso ele quer acessar, e valide se as permissões dele cobrem aquele recurso específico. Use listas de controle de acesso (ACLs) ou papéis (RBAC/ABAC) consistentemente em toda a API ou aplicação, nunca deixando a segurança implícita.

CVE-2026-62529LOWVulnerability in the Oracle Hyperion Calculation Manager product of Oracle Hyperion (component: Security). The supported version that is aEPSS 0.2%CVE-2026-13703MEDIUMSEO Redirection Plugin – 301 Redirect Manager < 9.19 - Subscriber+ Redirect Rule DisclosureEPSS 0.2%CVE-2021-32002MEDIUMSiteManager troubleshooter allows access without authentication from local networkEPSS 0.2%CVE-2025-46308MEDIUMAn authorization issue was addressed with improved state management. This issue is fixed in iOS 18.4 and iPadOS 18.4, macOS Sequoia 15.4. AnEPSS 0.2%CVE-2024-32045MEDIUMPlaybook run link to private channel grants channel accessEPSS 0.2%CVE-2023-52375MEDIUMPermission control vulnerability in the WindowManagerServices module.Successful exploitation of this vulnerability may affect availability.EPSS 0.2%CVE-2026-87260HIGHVulnerability in the Oracle Agile Engineering Data Management product of Oracle Supply Chain (component: Engineering Communication InterfaceEPSS 0.2%CVE-2026-84385MEDIUMA improper access control vulnerability in Fortinet FortiSOAR PaaS 7.6.0 through 7.6.6, FortiSOAR PaaS 7.5.0 through 7.5.3, FortiSOAR PaaS 7EPSS 0.2%CVE-2026-9522MEDIUMImproper access control in the PAM account discovery feature in Devolutions Server 2026.1.19 and earlier allows an authenticated user withouEPSS 0.2%CVE-2026-87959MEDIUMWPBot 8.7.2 - 8.7.5 - Subscriber+ Claude AI Settings UpdateEPSS 0.2%CVE-2026-74929MEDIUMWP Project Manager < 4.0.7 - Subscriber+ Cross-Project Task Disclosure and Task Board Modification via IDOREPSS 0.2%CVE-2026-14926MEDIUMFluentCart < 1.4.0 - Subscriber+ Subscription Payment-Method Tampering via IDOREPSS 0.2%CVE-2022-33706—Improper access control vulnerability in Samsung Gallery prior to version 13.1.05.8 allows physical attackers to access the pictures using SEPSS 0.2%CVE-2025-9795MEDIUMxujeff tianti 天梯 UploadController.java ajaxUploadFile unrestricted uploadEPSS 0.2%CVE-2021-25405—An improper access control vulnerability in ScreenOffActivity in Samsung Notes prior to version 4.2.04.27 allows untrusted applications to aEPSS 0.2%CVE-2026-22605MEDIUMOpenProject is Vulnerable to Insecure Direct Object Reference in MeetingsEPSS 0.2%CVE-2026-11549MEDIUMMultiple security vulnerabilities may affect IBM WebSphere Liberty that is shipped with IBM CICS TX Advanced.EPSS 0.2%CVE-2025-14338HIGHPolkit authentication dis isabled by default in inputplumberEPSS 0.2%CVE-2023-21985HIGHVulnerability in the Oracle Solaris product of Oracle Systems (component: Utility). Supported versions that are affected are 10 and 11. EaEPSS 0.2%CVE-2025-53113LOWGLPI technicians can access unauthorized information through external linksEPSS 0.2%