Falhas do tipo CWE-284

7.074 resultados

Controle de acesso inadequado a recursos

A aplicação falha em validar ou aplica incorretamente as restrições de acesso, permitindo que usuários não autorizados acessem dados ou funcionalidades que deveriam estar protegidas. É uma das fragilidades mais comuns em segurança: o código não verifica corretamente quem está pedindo acesso e simplesmente concede.

Exemplo

Um e-commerce que permite acessar o perfil de qualquer cliente substituindo o ID na URL (ex: /usuario/123 → /usuario/124), sem validar se o usuário autenticado é o dono daquele perfil. Um atacante consegue ver dados pessoais, histórico de compras e endereços de outras pessoas.

Como mitigar

Implemente verificações explícitas em cada acesso a recurso: autentique o usuário, identifique qual recurso ele quer acessar, e valide se as permissões dele cobrem aquele recurso específico. Use listas de controle de acesso (ACLs) ou papéis (RBAC/ABAC) consistentemente em toda a API ou aplicação, nunca deixando a segurança implícita.

CVE-2026-37709CRITICALInsecure Permissions vulnerability in grokability snipe-it v.8.4.0 and before and fixed after 2026-03-10 commit 676a9958 allows a remote attEPSS 0.8%CVE-2026-68004CRITICALAn issue in OSSRS SRS (Simple Realtime Server) <v5.0.213 allows a remote attacker to execute arbitrary code via RTMP publish authorization, EPSS 0.8%CVE-2026-78745CRITICALAn issue in HiDPT/ Weyon HiDPTAndroid Hi3751V350 Hi3751V352E_DMO allows a remote attacker to execute arbitrary code via the Android Debug BrEPSS 0.8%CVE-2022-4702MEDIUMRoyal Elementor Addons <= 1.3.59 - Insufficient Access Control to Plugin DeactivationEPSS 0.8%CVE-2022-4704MEDIUMRoyal Elementor Addons <= 1.3.59 - Insufficient Access Control to Template ImportEPSS 0.8%CVE-2023-6761MEDIUMThecosy IceCMS User Data access controlEPSS 0.8%CVE-2025-14749MEDIUMNingyuanda TC155 ONVIF PTZ Control device_service access controlEPSS 0.8%CVE-2022-37916HIGHBroken Access Control for some Web-based Management URLs in AirWave Management PlatformEPSS 0.8%CVE-2017-18035—The /rest/review-coverage-chart/1.0/data/<repository_name>/.json resource in Atlassian Fisheye and Crucible before version 4.5.1 and 4.6.0 wEPSS 0.8%CVE-2021-23176MEDIUMImproper access control in reporting engine of l10n_fr_fec module in Odoo Community 15.0 and earlier and Odoo Enterprise 15.0 and earlier alEPSS 0.8%CVE-2022-37918HIGHBroken Access Control for some Web-based Management URLs in AirWave Management PlatformEPSS 0.8%CVE-2018-0484MEDIUMCisco IOS and IOS XE Software Secure Shell Connection on VRF VulnerabilityEPSS 0.8%CVE-2022-37917HIGHBroken Access Control for some Web-based Management URLs in AirWave Management PlatformEPSS 0.8%CVE-2024-38175CRITICALAzure Managed Instance for Apache Cassandra Elevation of Privilege VulnerabilityEPSS 0.8%CVE-2023-43141—TOTOLINK A3700R V9.1.2u.6134_B20201202 and N600R V5.3c.5137 are vulnerable to Incorrect Access Control.EPSS 0.8%CVE-2023-26474CRITICALXWiki Platform vulnerable to privilege escalation via properties with wiki syntax that are executed with wrong authorEPSS 0.8%CVE-2026-58617HIGHM365 Copilot for iOS Elevation of Privilege VulnerabilityEPSS 0.8%CVE-2025-30425MEDIUMThis issue was addressed through improved state management. This issue is fixed in Safari 18.4, iOS 18.4 and iPadOS 18.4, iPadOS 17.7.6, macEPSS 0.8%CVE-2023-42769CRITICALSielco Radio Link and Analog FM Transmitters Improper Access ControlEPSS 0.8%CVE-2022-3382HIGHHIWIN Robot System Software version 3.3.21.9869 does not properly address the terminated command source. As a result, an attacker could crafEPSS 0.8%