Falhas do tipo CWE-284

7.967 resultados

Controle de acesso inadequado a recursos

A aplicação falha em validar ou aplica incorretamente as restrições de acesso, permitindo que usuários não autorizados acessem dados ou funcionalidades que deveriam estar protegidas. É uma das fragilidades mais comuns em segurança: o código não verifica corretamente quem está pedindo acesso e simplesmente concede.

Exemplo

Um e-commerce que permite acessar o perfil de qualquer cliente substituindo o ID na URL (ex: /usuario/123 → /usuario/124), sem validar se o usuário autenticado é o dono daquele perfil. Um atacante consegue ver dados pessoais, histórico de compras e endereços de outras pessoas.

Como mitigar

Implemente verificações explícitas em cada acesso a recurso: autentique o usuário, identifique qual recurso ele quer acessar, e valide se as permissões dele cobrem aquele recurso específico. Use listas de controle de acesso (ACLs) ou papéis (RBAC/ABAC) consistentemente em toda a API ou aplicação, nunca deixando a segurança implícita.

CVE-2024-44313HIGHTastyIgniter 3.7.6 contains an Incorrect Access Control vulnerability in the invoice() function within Orders.php which allows unauthorized EPSS 0.7%CVE-2022-46664HIGHA vulnerability has been identified in Mendix Workflow Commons (All versions < V2.4.0), Mendix Workflow Commons V2.1 (All versions < V2.1.4)EPSS 0.7%CVE-2021-35249MEDIUMDomain Admin Broken Access ControlEPSS 0.7%CVE-2025-53763CRITICALAzure Databricks Elevation of Privilege VulnerabilityEPSS 0.7%CVE-2024-54533HIGHA permissions issue was addressed with additional sandbox restrictions. This issue is fixed in macOS Sequoia 15.2, macOS Sonoma 14.7.5, macOEPSS 0.7%CVE-2023-25150MEDIUMDocument content of files can be obtained through Collabora for files of other usersEPSS 0.7%CVE-2024-45432HIGHOpenSynergy BlueSDK (aka Blue SDK) through 6.x mishandles a function call. The specific flaw exists within the BlueSDK Bluetooth stack. The EPSS 0.7%CVE-2023-3018MEDIUMSourceCodester Lost and Found Information System access controlEPSS 0.7%CVE-2021-28504HIGHOn Arista Strata family products which have “TCAM profile” feature enabled when Port IPv4 access-list has a rule which matches on “vxlan” as protocol then that rule and subsequent rules ( rules declared after it in ACL ) do not match on IP protocol fi ...EPSS 0.7%CVE-2011-1762—A flaw exists in Wordpress related to the 'wp-admin/press-this.php 'script improperly checking user permissions when publishing posts. This EPSS 0.7%CVE-2022-2578MEDIUMSourceCodester Garage Management System createUser.php access controlEPSS 0.7%CVE-2025-14286MEDIUMTenda AC9 Configuration File DownloadCfg.jpg information disclosureEPSS 0.7%CVE-2026-48204CRITICALApache Camel: Camel-MongoDB-GridFS: The gridfs.* control headers used non-Camel-prefixed names that bypass the HTTP header filter, allowing an HTTP client to switch the GridFS operation - including destructive file deletion - in the default configurationEPSS 0.7%CVE-2026-2550CRITICALEFM iptime A6004MX timepro.cgi commit_vpncli_file_upload unrestricted uploadEPSS 0.7%CVE-2024-33898CRITICALAxiros AXESS Auto Configuration Server (ACS) 4.x and 5.0.0 is affected by an Incorrect Access Control vulnerability. An authorization bypassEPSS 0.7%CVE-2021-4194MEDIUMImproper Access Control in bookstackapp/bookstackEPSS 0.7%CVE-2023-25161LOWNextcloud Server's missing rate limiting on password reset functionality allows sending lots of emailsEPSS 0.7%CVE-2022-4711MEDIUMRoyal Elementor Addons <= 1.3.59 - Insufficient Access Control to Menu Settings UpdateEPSS 0.7%CVE-2019-15998MEDIUMCisco IOS XR Software NETCONF Over Secure Shell ACL Bypass VulnerabilityEPSS 0.7%CVE-2024-56883HIGHSage DPW before 2024_12_001 is vulnerable to Incorrect Access Control. The implemented role-based access controls are not always enforced onEPSS 0.7%