Falhas do tipo CWE-284

7.967 resultados

Controle de acesso inadequado a recursos

A aplicação falha em validar ou aplica incorretamente as restrições de acesso, permitindo que usuários não autorizados acessem dados ou funcionalidades que deveriam estar protegidas. É uma das fragilidades mais comuns em segurança: o código não verifica corretamente quem está pedindo acesso e simplesmente concede.

Exemplo

Um e-commerce que permite acessar o perfil de qualquer cliente substituindo o ID na URL (ex: /usuario/123 → /usuario/124), sem validar se o usuário autenticado é o dono daquele perfil. Um atacante consegue ver dados pessoais, histórico de compras e endereços de outras pessoas.

Como mitigar

Implemente verificações explícitas em cada acesso a recurso: autentique o usuário, identifique qual recurso ele quer acessar, e valide se as permissões dele cobrem aquele recurso específico. Use listas de controle de acesso (ACLs) ou papéis (RBAC/ABAC) consistentemente em toda a API ou aplicação, nunca deixando a segurança implícita.

CVE-2024-0356MEDIUMMandelo ssm_shiro_blog Backend updateRoles access controlEPSS 0.6%CVE-2024-21767CRITICALCommend WS203VICM Improper Access ControlEPSS 0.6%CVE-2021-24500—Workreap theme < 2.2.2 - Multiple CSRF + IDOR VulnerabilitiesEPSS 0.6%CVE-2024-48955HIGHBroken access control in NetAdmin 4.030319 returns data with functionalities on the endpoint that "assembles" the functionalities menus, theEPSS 0.6%CVE-2026-2938MEDIUMSourceCodester Student Result Management System update_smtp.php access controlEPSS 0.6%CVE-2025-5649MEDIUMSourceCodester Student Result Management System Register Interface new_user access controlEPSS 0.6%CVE-2019-5014MEDIUMAn exploitable improper access control vulnerability exists in the bluetooth low energy functionality of Winco Fireworks FireFly FW-1007 V2.EPSS 0.6%CVE-2024-43503HIGHMicrosoft SharePoint Elevation of Privilege VulnerabilityEPSS 0.6%CVE-2025-63225CRITICALThe Eurolab ELTS100_UBX device (firmware version ELTS100v1.UBX) is vulnerable to Broken Access Control due to missing authentication on critEPSS 0.6%CVE-2025-30710MEDIUMVulnerability in the MySQL Cluster product of Oracle MySQL (component: Cluster: NDBCluster Plugin). Supported versions that are affected arEPSS 0.6%CVE-2022-31055HIGHImproper Access Control in kctfEPSS 0.6%CVE-2025-24968HIGHBusiness Logic And Unrestricted Project Deletion Lead To Take Over the System in reNgineEPSS 0.6%CVE-2023-21849HIGHVulnerability in the Oracle Applications DBA product of Oracle E-Business Suite (component: Java utils). Supported versions that are affectEPSS 0.6%CVE-2023-7223MEDIUMTotolink T6 cstecgi.cgi access controlEPSS 0.6%CVE-2024-45118MEDIUMAdobe Commerce | Improper Access Control (CWE-284)EPSS 0.6%CVE-2022-43977CRITICALAn issue was discovered on GE Grid Solutions MS3000 devices before 3.7.6.25p0_3.2.2.17p0_4.7p0. The debug port accessible via TCP (a qconn sEPSS 0.6%CVE-2024-46432HIGHTenda W18E V16.01.0.8(1625) is vulnerable to Incorrect Access Control. An attacker can send a specially crafted HTTP POST request to the setEPSS 0.6%CVE-2020-10143HIGHMacrium Reflect includes an OpenSSL component that specifies an OPENSSLDIR variable as C:\openssl\. Macrium Reflect contains a privileged seEPSS 0.6%CVE-2026-51674CRITICALIncorrect access control in the setScheduleCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to configure fEPSS 0.6%CVE-2026-51724CRITICALIncorrect access control in the delSmartQosCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to remove SmarEPSS 0.6%