Weaknesses of type CWE-425

137 results

Falha em aplicar autorização em URLs, scripts ou arquivos restritos

A aplicação web não valida adequadamente se o usuário tem permissão para acessar determinadas URLs, scripts ou arquivos antes de entregar o conteúdo. Um invasor contorna a interface de autenticação acessando diretamente recursos protegidos via URL, explorando a ausência de verificação de autorização no servidor.

Example

Uma aplicação permite que qualquer usuário logado acesse /admin/relatorios/exportar.php digitando a URL diretamente, sem verificar se é administrador. Ou um PDF de contrato privado fica acessível em /uploads/contrato_123.pdf sem checagem de propriedade, permitindo download por qualquer pessoa que descubra o nome do arquivo.

How to mitigate

Implemente verificação de autorização em TODA rota/recurso sensível (não confie em obscuridade de URL): antes de servir o conteúdo, valide se o usuário logado tem a role/permissão necessária. Use middleware de autorização centralizado, whitelist de recursos públicos, e bloqueie por padrão.

CVE-2026-108938MEDIUMcode-projects Matrimonial System matrimony.sql file accessEPSS 0.3%CVE-2025-26381MEDIUMOpenBlue Mobile Web Application configuration issue for optional for OpenBlue Workplace (formerly FM Systems)EPSS 0.3%CVE-2026-11986MEDIUMKeycloak-rest-admin-ui-ext: authorization bypass vulnerability in the admin-ui-ext bulk role-mapping-delete endpoints of keycloakEPSS 0.3%CVE-2025-52920MEDIUMInnoshop through 0.4.1 allows Insecure Direct Object Reference (IDOR) at multiple places within the frontend shop. Anyone can create a custoEPSS 0.3%CVE-2025-48202MEDIUMThe femanager extension through 8.2.1 for TYPO3 allows Insecure Direct Object Reference.EPSS 0.3%CVE-2026-34056HIGHOpenEMR has a Privilege Escalation that Allows a Low-Level User to View Admin-Only DataEPSS 0.3%CVE-2026-36453HIGHRhymix before 2.1.31 allows insecure direct object reference, aka RVE-2026-1. Arbitrary files can be accessed via extra variables.EPSS 0.3%CVE-2025-55736CRITICALflaskBlog allows arbitrary privilege escalationEPSS 0.3%CVE-2025-59797MEDIUMProfession Fit 5.0.99 Build 44910 allows authorization bypass via a direct request for /api/challenges/{id} and also URLs for eversports, thEPSS 0.3%CVE-2026-85627HIGHApache OFBiz: Authenticated Code Execution VulnerabilityEPSS 0.3%CVE-2026-33217HIGHNATS allows MQTT clients to bypass ACL checksEPSS 0.3%CVE-2026-9610LOWMultiple Vulnerabilities in IBM DatacapEPSS 0.3%CVE-2026-80275HIGHComelit 1456B gateway allows low priviledge user to overwrite installer password via unauthorized endpointEPSS 0.3%CVE-2025-10287LOWroncoo roncoo-pay orderQuery direct requestEPSS 0.3%CVE-2024-23573LOWHCL Aftermarket EPC is vulnerable to attack since the Application is vulnerable to Lucky 13. that makes the SS LLUCKY13 possible affects theEPSS 0.2%CVE-2026-102583LOWMoodle: incorrect capability check in ai generate image web serviceEPSS 0.2%CVE-2025-41404MEDIUMDirect request ('Forced Browsing') issue exists in iroha Board versions v0.10.12 and earlier. If this vulnerability is exploited, non-publicEPSS 0.2%CVE-2025-53073MEDIUMIn Sentry 25.1.0 through 25.5.1, an authenticated attacker can access a project's issue endpoint and perform unauthorized actions (such as aEPSS 0.2%CVE-2026-7500MEDIUMOrg.keycloak.keycloak-services: improper access control on keycloak server when the account account api feature is disabledEPSS 0.2%CVE-2025-57823LOWA direct request ('forced browsing') vulnerability in Fortinet FortiAuthenticator 6.6.0 through 6.6.6, FortiAuthenticator 6.5 all versions, EPSS 0.2%