Weaknesses of type CWE-73

768 results

Controle de acesso impróprio

Ocorre quando a aplicação falha em validar adequadamente quem pode acessar um recurso, função ou dado sensível. O código não verifica permissões corretamente — ou não verifica de jeito nenhum — permitindo que usuários não autorizados realizem ações que deveriam estar restritas.

Example

Um endpoint de API que deleta um cliente valida apenas se o usuário está logado, mas não verifica se ele é admin ou proprietário do cliente. Qualquer usuário autenticado consegue deletar qualquer cliente da plataforma.

How to mitigate

Implemente verificação explícita de permissões antes de toda ação sensível: verifique papel (role), escopo e propriedade do recurso. Use padrões como RBAC ou ABAC e teste casos onde usuários tentam acessar dados alheios.

CVE-2026-40086MEDIUMRembg has a Path Traversal via Custom Model LoadingEPSS 0.6%CVE-2026-8095HIGHFrontend File Manager Plugin <= 23.6 - Authenticated (Subscriber+) Arbitrary File DeletionEPSS 0.6%CVE-2024-25975MEDIUMArbitrary File OverwriteEPSS 0.6%CVE-2025-12529HIGHCost Calculator Builder <= 3.6.3 - Unauthenticated Arbitrary File DeletionEPSS 0.6%CVE-2026-92390HIGH-J no-clobber guarantee bypassed with 103 early hintsEPSS 0.6%CVE-2023-43074MEDIUM Dell Unity 5.3 contain(s) an Arbitrary File Creation vulnerability. A remote unauthenticated attacker could potentially exploit this vulnerEPSS 0.6%CVE-2026-121623HIGHSymfony: DataUriNormalizer Opens Data URIs With a Non-Lowercase Scheme as Local Files, Letting a Client Read Any Server FileEPSS 0.6%CVE-2026-9559CRITICALA path traversal vulnerability exists in the campaign import feature of Mautic 7. When extracting uploaded ZIP files during campaign importsEPSS 0.6%CVE-2026-19913HIGHCVE-2026-19913EPSS 0.6%CVE-2026-118515HIGHSymfony: The Serializer Builds UploadedFile Objects From Request Data, Letting a Client Point an Upload at Any Server FileEPSS 0.6%CVE-2026-10816HIGHArbitrary File Read (Unauthenticated)EPSS 0.6%CVE-2024-57394HIGHThe quarantine - restore function in Qi-ANXIN Tianqing Endpoint Security Management System v10.0 allows user to restore a malicious file to EPSS 0.6%CVE-2026-67429CRITICALFlyto2 Core: Arbitrary file write via image.download (and other file-writing modules)EPSS 0.6%CVE-2026-59819LOWLiteLLM: Local file read via request-supplied OIDC file referencesEPSS 0.6%CVE-2026-27211CRITICALCloud Hypervisor: Host File Exfiltration via QCOW Backing File AbuseEPSS 0.6%CVE-2025-65473CRITICALAn arbitrary file rename vulnerability in the /admin/filer.php component of EasyImages 2.0 v2.8.6 and below allows attackers with AdministraEPSS 0.6%CVE-2026-65125MEDIUMNVIDIA Infrastructure Controller for Linux contains a vulnerability where an attacker could cause external control of a file name or path. AEPSS 0.6%CVE-2026-35174CRITICALChyrp Lite has a Path Traversal to Remote Code ExecutionEPSS 0.6%CVE-2022-34765MEDIUMA CWE-73: External Control of File Name or Path vulnerability exists that could cause loading of unauthorized firmware images when user-contEPSS 0.6%CVE-2026-16926CRITICALVulnerabilities in IBM AIX and PowerVM VIOSEPSS 0.6%