Falhas do tipo CWE-284

7.967 resultados

Controle de acesso inadequado a recursos

A aplicação falha em validar ou aplica incorretamente as restrições de acesso, permitindo que usuários não autorizados acessem dados ou funcionalidades que deveriam estar protegidas. É uma das fragilidades mais comuns em segurança: o código não verifica corretamente quem está pedindo acesso e simplesmente concede.

Exemplo

Um e-commerce que permite acessar o perfil de qualquer cliente substituindo o ID na URL (ex: /usuario/123 → /usuario/124), sem validar se o usuário autenticado é o dono daquele perfil. Um atacante consegue ver dados pessoais, histórico de compras e endereços de outras pessoas.

Como mitigar

Implemente verificações explícitas em cada acesso a recurso: autentique o usuário, identifique qual recurso ele quer acessar, e valide se as permissões dele cobrem aquele recurso específico. Use listas de controle de acesso (ACLs) ou papéis (RBAC/ABAC) consistentemente em toda a API ou aplicação, nunca deixando a segurança implícita.

CVE-2025-48983CRITICALA vulnerability in the Mount service of Veeam Backup & Replication, which allows for remote code execution (RCE) on the Backup infrastructurEPSS 0.8%CVE-2024-13067MEDIUMCodeAstro Online Food Ordering System All Users Page all_users.php access controlEPSS 0.8%CVE-2021-45111HIGHImproper access control in Odoo Community 15.0 and earlier and Odoo Enterprise 15.0 and earlier allows remote authenticated users to triggerEPSS 0.8%CVE-2023-1647HIGHImproper Access Control in calcom/cal.comEPSS 0.8%CVE-2023-22920CRITICALA security misconfiguration vulnerability exists in the Zyxel LTE3316-M604 firmware version V2.00(ABMP.6)C0 due to a factory default misconfEPSS 0.8%CVE-2025-47161HIGHMicrosoft Defender for Endpoint Elevation of Privilege VulnerabilityEPSS 0.8%CVE-2022-0574MEDIUMImproper Access Control in publify/publifyEPSS 0.8%CVE-2024-25501HIGHAn issue WinMail v.7.1 and v.5.1 and before allows a remote attacker to execute arbitrary code via a crafted script to the email parameter.EPSS 0.8%CVE-2024-28960HIGHAn issue was discovered in Mbed TLS 2.18.0 through 2.28.x before 2.28.8 and 3.x before 3.6.0, and Mbed Crypto. The PSA Crypto API mishandlesEPSS 0.8%CVE-2021-23845HIGHB426 Web Configuration Authentication BypassEPSS 0.8%CVE-2024-20969MEDIUMVulnerability in the MySQL Server product of Oracle MySQL (component: Server: DDL). Supported versions that are affected are 8.0.35 and priEPSS 0.8%CVE-2026-43945HIGHFUXA Vulnerable to Pre-auth RCE via Path Manipulation & Configuration InjectionEPSS 0.8%CVE-2022-4702MEDIUMRoyal Elementor Addons <= 1.3.59 - Insufficient Access Control to Plugin DeactivationEPSS 0.8%CVE-2022-4704MEDIUMRoyal Elementor Addons <= 1.3.59 - Insufficient Access Control to Template ImportEPSS 0.8%CVE-2021-3967MEDIUMImproper Access Control in zulip/zulipEPSS 0.8%CVE-2026-28862MEDIUMA privacy issue was addressed with improved private data redaction for log entries. This issue is fixed in macOS Sequoia 15.7.5, macOS SonomEPSS 0.8%CVE-2024-46430MEDIUMTenda W18E V16.01.0.8(1625) is vulnerable to Incorrect Access Control. Unauthorized password change via the web management portal allows an EPSS 0.8%CVE-2023-49978HIGHIncorrect access control in Customer Support System v1 allows non-administrator users to access administrative pages and execute actions resEPSS 0.8%CVE-2022-34827HIGHCarel Boss Mini 1.5.0 has Improper Access Control.EPSS 0.8%CVE-2023-24425MEDIUMJenkins Kubernetes Credentials Provider Plugin 1.208.v128ee9800c04 and earlier does not set the appropriate context for Kubernetes credentiaEPSS 0.8%