Falhas do tipo CWE-284

7.174 resultados

Controle de acesso inadequado a recursos

A aplicação falha em validar ou aplica incorretamente as restrições de acesso, permitindo que usuários não autorizados acessem dados ou funcionalidades que deveriam estar protegidas. É uma das fragilidades mais comuns em segurança: o código não verifica corretamente quem está pedindo acesso e simplesmente concede.

Exemplo

Um e-commerce que permite acessar o perfil de qualquer cliente substituindo o ID na URL (ex: /usuario/123 → /usuario/124), sem validar se o usuário autenticado é o dono daquele perfil. Um atacante consegue ver dados pessoais, histórico de compras e endereços de outras pessoas.

Como mitigar

Implemente verificações explícitas em cada acesso a recurso: autentique o usuário, identifique qual recurso ele quer acessar, e valide se as permissões dele cobrem aquele recurso específico. Use listas de controle de acesso (ACLs) ou papéis (RBAC/ABAC) consistentemente em toda a API ou aplicação, nunca deixando a segurança implícita.

CVE-2026-72693HIGHKbd: local privilege escalation in openvt via incorrect process owner verification allowing passwordless root loginEPSS 0.1%CVE-2024-54096MEDIUMVulnerability of improper access control in the MTP module Impact: Successful exploitation of this vulnerability may affect integrity and acEPSS 0.1%CVE-2026-23856HIGHDell iDRAC Service Module (iSM) for Windows, versions prior to 6.0.3.1, and Dell iDRAC Service Module (iSM) for Linux, versions prior to 5.4EPSS 0.1%CVE-2026-61079MEDIUMVulnerability in Oracle GoldenGate (component: Libraries). Supported versions that are affected are 19.1.0.0.0-19.30.0.0, 21.3-21.21 and 2EPSS 0.1%CVE-2023-50300MEDIUMIBM Transformation Extender Advanced improper access controlEPSS 0.1%CVE-2025-46691HIGHDell PremierColor Panel Driver, versions prior to 1.0.0.1 A01, contains an Improper Access Control vulnerability. A low privileged attacker EPSS 0.1%CVE-2024-0025HIGHIn sendIntentSender of ActivityManagerService.java, there is a possible background activity launch due to a logic error. This could lead to EPSS 0.1%CVE-2021-25412—An improper access control vulnerability in genericssoservice prior to SMR JUN-2021 Release 1 allows local attackers to execute protected acEPSS 0.1%CVE-2026-15060MEDIUMsystemd-machined: unprivileged users can terminate arbitrary processesEPSS 0.1%CVE-2026-71149MEDIUMVulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security). The supported version that is EPSS 0.1%CVE-2022-33243HIGHImproper access control in Qualcomm IPCEPSS 0.1%CVE-2026-71078MEDIUMVulnerability in the Oracle Agile PLM MCAD Connector product of Oracle Supply Chain (component: CAX Client). The supported version that isEPSS 0.1%CVE-2026-11459MEDIUMSecureAge CatchPulse IOCTL saappctl.sys information disclosureEPSS 0.1%CVE-2022-26091MEDIUMImproper access control vulnerability in Knox Manage prior to SMR Apr-2022 Release 1 allows that physical attackers can bypass Knox Manage uEPSS 0.1%CVE-2021-25359MEDIUMAn improper SELinux policy prior to SMR APR-2021 Release 1 allows local attackers to access AP information without proper permissions via unEPSS 0.1%CVE-2025-22391MEDIUMImproper access control for some SigTest before version 6.1.10 within Ring 3: User Applications may allow an escalation of privilege. UnprivEPSS 0.1%CVE-2016-10408HIGHImproper Access Control in Core.EPSS 0.1%CVE-2026-21109LOWImproper access control in Watch Plugin prior to Android Watch 17 allows local attackers to access sensitive information.EPSS 0.1%CVE-2026-41984MEDIUMUAF vulnerability in the package management module. Impact: Successful exploitation of this vulnerability may affect service integrity.EPSS 0.1%CVE-2025-46589MEDIUMVulnerability of unauthorized access in the app lock module Impact: Successful exploitation of this vulnerability will affect integrity and EPSS 0.1%