Weaknesses of type CWE-73

768 results

Controle de acesso impróprio

Ocorre quando a aplicação falha em validar adequadamente quem pode acessar um recurso, função ou dado sensível. O código não verifica permissões corretamente — ou não verifica de jeito nenhum — permitindo que usuários não autorizados realizem ações que deveriam estar restritas.

Example

Um endpoint de API que deleta um cliente valida apenas se o usuário está logado, mas não verifica se ele é admin ou proprietário do cliente. Qualquer usuário autenticado consegue deletar qualquer cliente da plataforma.

How to mitigate

Implemente verificação explícita de permissões antes de toda ação sensível: verifique papel (role), escopo e propriedade do recurso. Use padrões como RBAC ou ABAC e teste casos onde usuários tentam acessar dados alheios.

CVE-2025-0109MEDIUMPAN-OS: Unauthenticated File Deletion Vulnerability on the Management Web InterfaceEPSS 0.6%CVE-2025-65115HIGHRemote Code Execution Vulnerability in JP1/IT Desktop Management 2 and JP1/NETM/DMEPSS 0.6%CVE-2025-29708CRITICALSourceCodester Company Website CMS 1.0 contains a file upload vulnerability via the "Create Services" file /dashboard/Services.EPSS 0.6%CVE-2025-29709CRITICALSourceCodester Company Website CMS 1.0 has a File upload vulnerability via the "Create portfolio" file /dashboard/portfolio.EPSS 0.6%CVE-2026-35593MEDIUMTrilium Notes has Local File Inclusion via upload modified file API endpointEPSS 0.6%CVE-2026-40421MEDIUMMicrosoft Word Information Disclosure VulnerabilityEPSS 0.6%CVE-2026-39907HIGHUnisys WebPerfect Image Suite 3.0 NTLMv2 Hash Leakage via WCF SOAPEPSS 0.6%CVE-2025-52465HIGHGeoServer has an arbitrary file write vulnerability in its Master Password Dump PageEPSS 0.6%CVE-2026-72841CRITICALluci-app-openvpn Path Traversal RCE via instance_name2EPSS 0.6%CVE-2026-14480HIGHOpenPLC v3 External Control of File Name or PathEPSS 0.6%CVE-2026-72842CRITICALOpenWrt luci-app-lxc ACL Inconsistency Authentication BypassEPSS 0.6%CVE-2026-55477HIGHAuthenticated Arbitrary File Write via Database Import and Xray Log Path ManipulationEPSS 0.6%CVE-2022-42893HIGHA vulnerability has been identified in syngo Dynamics (All versions < VA40G HF01). syngo Dynamics application server hosts a web service usiEPSS 0.6%CVE-2026-62804HIGHMicrosoft Word Remote Code Execution VulnerabilityEPSS 0.6%CVE-2026-92189CRITICALQuest Foglight for Databases writeTopologySectionToFile External Control of File Path Remote Code Execution VulnerabilityEPSS 0.6%CVE-2026-58293HIGHMicrosoft Edge (Chromium-based) Remote Code Execution VulnerabilityEPSS 0.6%CVE-2026-85668HIGHXinference 3.3.0 Unauthenticated Arbitrary-Path File Read via /v1/models/llm/auto-registerEPSS 0.6%CVE-2024-2150MEDIUMSourceCodester Insurance Management System file inclusionEPSS 0.6%CVE-2024-37295HIGHAimeos Core remote code execution in web server contextEPSS 0.6%CVE-2022-42891HIGHA vulnerability has been identified in syngo Dynamics (All versions < VA40G HF01). syngo Dynamics application server hosts a web service usiEPSS 0.6%