Falhas do tipo CWE-284

7.169 resultados

Controle de acesso inadequado a recursos

A aplicação falha em validar ou aplica incorretamente as restrições de acesso, permitindo que usuários não autorizados acessem dados ou funcionalidades que deveriam estar protegidas. É uma das fragilidades mais comuns em segurança: o código não verifica corretamente quem está pedindo acesso e simplesmente concede.

Exemplo

Um e-commerce que permite acessar o perfil de qualquer cliente substituindo o ID na URL (ex: /usuario/123 → /usuario/124), sem validar se o usuário autenticado é o dono daquele perfil. Um atacante consegue ver dados pessoais, histórico de compras e endereços de outras pessoas.

Como mitigar

Implemente verificações explícitas em cada acesso a recurso: autentique o usuário, identifique qual recurso ele quer acessar, e valide se as permissões dele cobrem aquele recurso específico. Use listas de controle de acesso (ACLs) ou papéis (RBAC/ABAC) consistentemente em toda a API ou aplicação, nunca deixando a segurança implícita.

CVE-2025-12182MEDIUMQi Blocks <= 1.4.3 - Missing Authorization to Arbitrary Attachment ResizeEPSS 0.2%CVE-2026-105692MEDIUMPenpot: IDOR in Share-Link Deletion Allows Any File Editor to Delete Share-Links They Did Not CreateEPSS 0.2%CVE-2023-43086HIGH Dell Command | Configure, versions prior to 4.11.0, contains an improper access control vulnerability. A local malicious user could potentiEPSS 0.2%CVE-2023-27517MEDIUMImproper access control in some Intel(R) Optane(TM) PMem software before versions 01.00.00.3547, 02.00.00.3915, 03.00.00.0483 may allow an aEPSS 0.2%CVE-2022-20716HIGHCisco SD-WAN Solution Improper Access Control VulnerabilityEPSS 0.2%CVE-2026-11621MEDIUMDcat-Admin User Setting upload editorMDUpload unrestricted uploadEPSS 0.2%CVE-2022-24923MEDIUMImproper access control vulnerability in Samsung SearchWidget prior to versions 2.3.00.6 in China models allows untrusted applications to loEPSS 0.2%CVE-2025-67437MEDIUMMedical Management System a81df1ce700a9662cb136b27af47f4cbde64156b is vulnerable to Insecure Permissions, which allows arbitrary user passwoEPSS 0.2%CVE-2026-102263MEDIUMmwasikz robo-cafe-rms manage-food.php unrestricted uploadEPSS 0.2%CVE-2025-2348MEDIUMIROAD Dash Cam FX2 HTTP/RTSP event information disclosureEPSS 0.2%CVE-2026-71147MEDIUMVulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security). The supported version that is EPSS 0.2%CVE-2024-32044MEDIUMImproper access control for some Intel(R) Arc(TM) Pro Graphics for Windows drivers before version 31.0.101.5319 may allow an authenticated uEPSS 0.2%CVE-2025-43291MEDIUMA permissions issue was addressed by removing the vulnerable code. This issue is fixed in macOS Sequoia 15.7, macOS Sonoma 14.8, macOS TahoeEPSS 0.2%CVE-2022-40207HIGHImproper access control in the Intel(R) SUR software before version 2.4.8989 may allow an authenticated user to potentially enable escalatioEPSS 0.2%CVE-2026-1411MEDIUMBeetel 777VR1 UART access controlEPSS 0.2%CVE-2025-6680MEDIUMTutor LMS <= 3.8.3 - Missing Authorization to Sensitive Information ExposureEPSS 0.2%CVE-2026-12490HIGHBypass of client certificate verification with transfer over TLSEPSS 0.2%CVE-2026-11193MEDIUMInsufficient policy enforcement in Password Manager in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to bypass discretionarEPSS 0.2%CVE-2021-1419HIGHCisco Access Points SSH Management Privilege Escalation VulnerabilityEPSS 0.2%CVE-2026-48928MEDIUMA inconsistency in Node.js hostname matching can cause a trust-policy bypass in multi-context mTLS setups. This vulnerability affects allEPSS 0.2%