Weaknesses of type CWE-73

768 results

Controle de acesso impróprio

Ocorre quando a aplicação falha em validar adequadamente quem pode acessar um recurso, função ou dado sensível. O código não verifica permissões corretamente — ou não verifica de jeito nenhum — permitindo que usuários não autorizados realizem ações que deveriam estar restritas.

Example

Um endpoint de API que deleta um cliente valida apenas se o usuário está logado, mas não verifica se ele é admin ou proprietário do cliente. Qualquer usuário autenticado consegue deletar qualquer cliente da plataforma.

How to mitigate

Implemente verificação explícita de permissões antes de toda ação sensível: verifique papel (role), escopo e propriedade do recurso. Use padrões como RBAC ou ABAC e teste casos onde usuários tentam acessar dados alheios.

CVE-2026-106219MEDIUMIn JetBrains TeamCity before 2026.2.1 missing validation of Git submodule URLs allowed reading local repositories on the serverEPSS 0.7%CVE-2026-48753CRITICALIncus has an arbitrary file write via path traversal in S3 multipart uploadEPSS 0.7%CVE-2024-0728MEDIUMForU CMS channel.php file inclusionEPSS 0.7%CVE-2025-4602MEDIUMeMagicOne Store Manager for WooCommerce <= 1.2.5 - Unauthenticated Arbitrary File ReadEPSS 0.7%CVE-2024-30265HIGHVoilà Local file inclusionEPSS 0.7%CVE-2025-3419HIGHEvent Manager, Events Calendar, Tickets, Registrations – Eventin <= 4.0.26 - Unauthenticated Arbitrary File ReadEPSS 0.7%CVE-2026-26157HIGHBusybox: busybox: arbitrary file overwrite and potential code execution via incomplete path sanitizationEPSS 0.7%CVE-2026-18127HIGHExternal control of a filename in the Core of Ivanti Endpoint Manager before version 2024 SU7 allows a remote authenticated attacker full wrEPSS 0.7%CVE-2023-6569CRITICALExternal Control of File Name or Path in h2oai/h2o-3EPSS 0.7%CVE-2026-30281CRITICALAn arbitrary file overwrite vulnerability in MaruNuri LLC v2.0.23 allows attackers to overwrite critical internal files via the file import EPSS 0.7%CVE-2026-86189CRITICALWWBN AVideo Unauthenticated Path Traversal via notify.ffmpeg.json.phpEPSS 0.7%CVE-2019-14905HIGHA vulnerability was found in Ansible Engine versions 2.9.x before 2.9.3, 2.8.x before 2.8.8, 2.7.x before 2.7.16 and earlier, where in AnsibEPSS 0.7%CVE-2024-10492LOWKeycloak-quarkus-server: keycloak path trasversalEPSS 0.7%CVE-2023-1105HIGHExternal Control of File Name or Path in flatpressblog/flatpressEPSS 0.7%CVE-2022-31739HIGHWhen downloading files on Windows, the % character was not escaped, which could have lead to a download incorrectly being saved to attacker-EPSS 0.7%CVE-2026-13014CRITICALRemote Code Execution vulnerability in "Suspicious" applicationEPSS 0.7%CVE-2024-5986CRITICALRemote Arbitrary File Write with Arbitrary Data in h2oai/h2o-3EPSS 0.7%CVE-2026-46652CRITICALPath traversal via HTTP `Content-Disposition` header in ExternalFilesDownloader enables remote code execution in Goobi viewerEPSS 0.7%CVE-2022-42732HIGHA vulnerability has been identified in syngo Dynamics (All versions < VA40G HF01). syngo Dynamics application server hosts a web service usiEPSS 0.7%CVE-2025-0211MEDIUMCampcodes School Faculty Scheduling System index.php file inclusionEPSS 0.7%