Falhas do tipo CWE-284

7.070 resultados

Controle de acesso inadequado a recursos

A aplicação falha em validar ou aplica incorretamente as restrições de acesso, permitindo que usuários não autorizados acessem dados ou funcionalidades que deveriam estar protegidas. É uma das fragilidades mais comuns em segurança: o código não verifica corretamente quem está pedindo acesso e simplesmente concede.

Exemplo

Um e-commerce que permite acessar o perfil de qualquer cliente substituindo o ID na URL (ex: /usuario/123 → /usuario/124), sem validar se o usuário autenticado é o dono daquele perfil. Um atacante consegue ver dados pessoais, histórico de compras e endereços de outras pessoas.

Como mitigar

Implemente verificações explícitas em cada acesso a recurso: autentique o usuário, identifique qual recurso ele quer acessar, e valide se as permissões dele cobrem aquele recurso específico. Use listas de controle de acesso (ACLs) ou papéis (RBAC/ABAC) consistentemente em toda a API ou aplicação, nunca deixando a segurança implícita.

CVE-2026-4180MEDIUMD-Link DIR-816 goahead redirect.asp access controlEPSS 3.0%CVE-2023-29922MEDIUMPowerJob V4.3.1 is vulnerable to Incorrect Access Control via the create user/save interface.EPSS 3.0%CVE-2020-8300—Citrix ADC and Citrix/NetScaler Gateway before 13.0-82.41, 12.1-62.23, 11.1-65.20 and Citrix ADC 12.1-FIPS before 12.1-55.238 suffer from imEPSS 3.0%CVE-2019-15260CRITICALCisco Aironet Access Points Unauthorized Access VulnerabilityEPSS 3.0%CVE-2022-32800MEDIUMThis issue was addressed with improved checks. This issue is fixed in Security Update 2022-005 Catalina, macOS Big Sur 11.6.8, macOS MontereEPSS 3.0%CVE-2019-9884CRITICALeClass platform contains a Broken Access Control vulnerabilityEPSS 3.0%CVE-2025-59512HIGHCustomer Experience Improvement Program (CEIP) Elevation of Privilege VulnerabilityEPSS 2.9%CVE-2025-27140CRITICALWeGIA vulnerable to OS Command Injection at endpoint 'importar_dump.php' parameter 'import' (RCE)EPSS 2.9%CVE-2026-20929HIGHWindows HTTP.sys Elevation of Privilege VulnerabilityEPSS 2.9%CVE-2022-21291MEDIUMVulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Hotspot). Supported versions thEPSS 2.9%CVE-2020-3284HIGHCisco IOS XR Software Enhanced Preboot eXecution Environment Unsigned Code Execution VulnerabilityEPSS 2.9%CVE-2020-3144CRITICALCisco RV110W, RV130, RV130W, and RV215W Routers Authentication Bypass VulnerabilityEPSS 2.9%CVE-2021-26559—CWE-284 Improper Access Control on Configurations Endpoint for the Stable APIEPSS 2.8%CVE-2018-13816—A vulnerability has been identified in TIM 1531 IRC (All version < V2.0). The devices was missing proper authentication on port 102/tcp, altEPSS 2.8%CVE-2025-54098HIGHWindows Hyper-V Elevation of Privilege VulnerabilityEPSS 2.8%CVE-2022-21305MEDIUMVulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Hotspot). Supported versions thEPSS 2.8%CVE-2026-20896CRITICALGitea Docker image trusts spoofable reverse-proxy headers by defaultEPSS 2.8%CVE-2022-26926HIGHWindows Address Book Remote Code Execution VulnerabilityEPSS 2.7%CVE-2022-21619LOWVulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Security). Supported versions tEPSS 2.7%CVE-2025-59230HIGHWindows Remote Access Connection Manager Elevation of Privilege VulnerabilityEPSS 2.7%KEV