Weaknesses of type CWE-73

768 results

Controle de acesso impróprio

Ocorre quando a aplicação falha em validar adequadamente quem pode acessar um recurso, função ou dado sensível. O código não verifica permissões corretamente — ou não verifica de jeito nenhum — permitindo que usuários não autorizados realizem ações que deveriam estar restritas.

Example

Um endpoint de API que deleta um cliente valida apenas se o usuário está logado, mas não verifica se ele é admin ou proprietário do cliente. Qualquer usuário autenticado consegue deletar qualquer cliente da plataforma.

How to mitigate

Implemente verificação explícita de permissões antes de toda ação sensível: verifique papel (role), escopo e propriedade do recurso. Use padrões como RBAC ou ABAC e teste casos onde usuários tentam acessar dados alheios.

CVE-2026-48750CRITICALIncus has an arbitrary file write on host via `exec-output` symlink in crafted imageEPSS 0.8%CVE-2025-66449HIGHConvertX has Path Traversal that leads to Arbitrary File Write and Arbitrary Code ExecutionEPSS 0.8%CVE-2023-3256HIGHAdvantech R-SeeNet External Control of File Name or PathEPSS 0.8%CVE-2025-47956MEDIUMWindows Security App Spoofing VulnerabilityEPSS 0.8%CVE-2024-2917MEDIUMCampcodes House Rental Management System index.php file inclusionEPSS 0.8%CVE-2026-49441CRITICALWazuh : peer-controlled metadata key in process_files_from_worker non-merged branch allows arbitrary file write under WAZUH_PATH on Wazuh managerEPSS 0.8%CVE-2026-56452HIGHApache MINA SSHD: Path traversal in SCP file receptionEPSS 0.8%CVE-2026-59976HIGHConvertX: Path Traversal vulnerability leading to Arbitrary File WriteEPSS 0.8%CVE-2026-50148CRITICALMetabase: Remote Code Execution via Snowflake JDBC Driver Arbitrary File WriteEPSS 0.8%CVE-2026-6070CRITICALWP-BusinessDirectory <= 4.0.1 - Unauthenticated Arbitrary File Deletion via Path Traversal via '_filename' ParameterEPSS 0.8%CVE-2026-10303HIGHServerCo getssl ACME shell script path injectionEPSS 0.8%CVE-2026-5821HIGHImage Optimizer <= 1.7.4 - Authenticated (Author+) Arbitrary File Deletion via Post Meta Field InjectionEPSS 0.8%CVE-2026-111230MEDIUMNetgate pfSense CE through 2.9.0 Local File Read via Dynamic DNS Update URLEPSS 0.8%CVE-2026-47643CRITICALAzure Stack Edge Remote Code Execution VulnerabilityEPSS 0.8%CVE-2024-7626HIGHWP Delicious – Recipe Plugin for Food Bloggers (formerly Delicious Recipes) <= 1.6.9 - Improper Path Validation to Authenticated (Subscriber+) Arbitrary File Move and ReadEPSS 0.8%CVE-2024-7911MEDIUMSourceCodester Simple Online Bidding System index.php file inclusionEPSS 0.7%CVE-2026-46402HIGHMicrosoft UFO uses untrusted task_name in log paths, allowing authenticated path traversal and log file creation outside the logs directoryEPSS 0.7%CVE-2026-16137HIGHPath traversal via unsanitized upload filename leads to arbitrary file write in Progress ShareFile Storage Zones ControllerEPSS 0.7%CVE-2026-42845HIGHGrav: Anonymous Page Content Overwrite via Form File Upload filename OverrideEPSS 0.7%CVE-2021-47746HIGHNodeBB Plugin Emoji 3.2.1 - Arbitrary File WriteEPSS 0.7%