Falhas do tipo CWE-284

7.076 resultados

Controle de acesso inadequado a recursos

A aplicação falha em validar ou aplica incorretamente as restrições de acesso, permitindo que usuários não autorizados acessem dados ou funcionalidades que deveriam estar protegidas. É uma das fragilidades mais comuns em segurança: o código não verifica corretamente quem está pedindo acesso e simplesmente concede.

Exemplo

Um e-commerce que permite acessar o perfil de qualquer cliente substituindo o ID na URL (ex: /usuario/123 → /usuario/124), sem validar se o usuário autenticado é o dono daquele perfil. Um atacante consegue ver dados pessoais, histórico de compras e endereços de outras pessoas.

Como mitigar

Implemente verificações explícitas em cada acesso a recurso: autentique o usuário, identifique qual recurso ele quer acessar, e valide se as permissões dele cobrem aquele recurso específico. Use listas de controle de acesso (ACLs) ou papéis (RBAC/ABAC) consistentemente em toda a API ou aplicação, nunca deixando a segurança implícita.

CVE-2022-39329LOWProfile of disabled user stays accessibleEPSS 0.7%CVE-2025-2219MEDIUMLoveCards LoveCardsV2 image unrestricted uploadEPSS 0.7%CVE-2026-7813CRITICALpgAdmin 4: Cross-user data access and shared-server privilege escalation in server modeEPSS 0.7%CVE-2022-42707HIGHIn Mahara 21.04 before 21.04.7, 21.10 before 21.10.5, 22.04 before 22.04.3, and 22.10 before 22.10.0, embedded images are accessible withoutEPSS 0.7%CVE-2024-38163HIGHWindows Update Stack Elevation of Privilege VulnerabilityEPSS 0.7%CVE-2026-34572HIGHCI4MS: Account Deactivation Module Full Persistent Unauthorized Access for All‑Roles via Improper Session Invalidation (Logic Flaw)EPSS 0.7%CVE-2023-51065HIGHIncorrect access control in QStar Archive Solutions Release RELEASE_3-0 Build 7 Patch 0 allows unauthenticated attackers to obtain system baEPSS 0.7%CVE-2026-34570HIGHCI4MS: Account Deletion Module Full Persistent Unauthorized Access for All‑Roles via Improper Session Invalidation (Logic Flaw)EPSS 0.7%CVE-2024-43503HIGHMicrosoft SharePoint Elevation of Privilege VulnerabilityEPSS 0.7%CVE-2025-4535MEDIUMGosuncn Technology Group Audio-Visual Integrated Management Platform Configuration File config.properties information disclosureEPSS 0.7%CVE-2025-4536MEDIUMGosuncn Technology Group Audio-Visual Integrated Management Platform listByPage information disclosureEPSS 0.7%CVE-2024-41518HIGHAn Incorrect Access Control vulnerability in "/admin/programm/<program_id>/export/statistics" in Feripro <= v2.2.3 allows remote attackers tEPSS 0.7%CVE-2022-44037HIGHAn access control issue in APsystems ENERGY COMMUNICATION UNIT (ECU-C) Power Control Software V4.1NA, V3.11.4, W2.1NA, V4.1SAA, C1.2.2 allowEPSS 0.6%CVE-2023-5288CRITICAL A remote unauthorized attacker may connect to the SIM1012, interact with the device and change configuration settings. The adversary may alEPSS 0.6%CVE-2024-45170HIGHAn issue was discovered in za-internet C-MOR Video Surveillance 5.2401. Due to improper or missing access control, low privileged users can EPSS 0.6%CVE-2024-57032CRITICALWeGIA < 3.2.0 is vulnerable to Incorrect Access Control in controle/control.php. The application does not validate the value of the old passEPSS 0.6%CVE-2024-0356MEDIUMMandelo ssm_shiro_blog Backend updateRoles access controlEPSS 0.6%CVE-2024-21767CRITICALCommend WS203VICM Improper Access ControlEPSS 0.6%CVE-2024-28120MEDIUMAPI key leak in codeium-chromeEPSS 0.6%CVE-2026-31272CRITICALMRCMS 3.1.2 contains an access control vulnerability. The save() method in src/main/java/org/marker/mushroom/controller/UserController.java EPSS 0.6%