Weaknesses of type CWE-610

100 results

Controle de acesso inadequado

A aplicação não valida corretamente se um usuário tem permissão para acessar um recurso, operação ou dado específico. O resultado é que usuários não autorizados conseguem contornar as verificações de autenticação ou autorização e acessar informações sensíveis ou executar ações que não deveriam.

Example

Um sistema web que permite visualizar perfil de qualquer usuário apenas mudando o ID na URL (exemplo: /perfil/123 para /perfil/124), sem verificar se o usuário logado é o dono daquele perfil. Um atacante enumera IDs e extrai dados pessoais alheios.

How to mitigate

Sempre validar, no servidor, se o usuário autenticado tem permissão explícita para o recurso solicitado — nunca confiar apenas em parâmetros do cliente. Use modelos de autorização bem definidos (RBAC, ABAC) e testes de acesso em todas as rotas sensíveis.

CVE-2026-15583HIGHSSRF (confused deputy) in Grafana MCP Server via X-Grafana-URL headerEPSS 0.5%CVE-2024-32980CRITICALSpin contains a potential network sandbox escape for specifically configured Spin applicationsEPSS 0.5%CVE-2026-47357CRITICALTerrascan v1.18.3 and prior are vulnerable to Server-Side Request Forgery (SSRF) via the remote_url parameter in the remote directory scan eEPSS 0.5%CVE-2026-47358CRITICALTerrascan v1.18.3 and prior are vulnerable to Server-Side Request Forgery (SSRF) via external URL resolution in uploaded IaC templates when EPSS 0.5%CVE-2025-9065HIGHRockwell Automation ThinManager® Server-Side Request Forgery VulnerabilityEPSS 0.5%CVE-2022-23439MEDIUMA externally controlled reference to a resource in another sphere vulnerability in Fortinet allows attacker to poison web caches via crafteEPSS 0.5%CVE-2023-38046MEDIUMPAN-OS: Read System Files and Resources During Configuration CommitEPSS 0.5%CVE-2025-5877MEDIUMFengoffice Feng Office Document Upload ApplicationDataObject.class.php xml external entity referenceEPSS 0.5%CVE-2026-62960HIGHGit for Windows: Server-advertised bundle-uri can trigger outbound SMB callbacks via UNC and file:// paths on WindowsEPSS 0.5%CVE-2026-76572MEDIUMpkp pkp-lib XSLTransformer.php _transformPHP xml external entity referenceEPSS 0.5%CVE-2026-79256HIGHExternally controlled reference in WebView in Google Chrome on on Android prior to 152.0.7977.65 allowed a remote attacker who had compromisEPSS 0.4%CVE-2025-2875HIGHCWE-610: Externally Controlled Reference to a Resource in Another Sphere vulnerability exists that could cause a loss of confidentiality wheEPSS 0.4%CVE-2026-119342MEDIUMStirling-PDF: SVG→PDF local file read (LFI) via SVG-sanitizer and Batik same-origin bypassEPSS 0.4%CVE-2026-32008HIGHOpenClaw < 2026.2.21 - Arbitrary Local File Read via Browser Navigation GuardEPSS 0.4%CVE-2025-11035MEDIUMJinher OA text xml external entity referenceEPSS 0.4%CVE-2026-12788MEDIUMzhilink 智互联(深圳)科技有限公司 ADP Application Developer Platform 应用开发者平台 XML Parser import xml external entity referenceEPSS 0.4%CVE-2026-3404LOWthinkgem JeeSite Endpoint CasOutHandler.java xml external entity referenceEPSS 0.4%CVE-2024-6717HIGHNomad Vulnerable to Allocation Directory Path Escape Through Archive UnpackingEPSS 0.4%CVE-2024-42168HIGHHCL MyXalytics is affected by out-of-band resource load (HTTP) vulnerabilityEPSS 0.4%CVE-2025-1225MEDIUMywoa WXCallBack Interface XMLParse.java extract xml external entity referenceEPSS 0.4%