Weaknesses of type CWE-73

668 results

Controle de acesso impróprio

Ocorre quando a aplicação falha em validar adequadamente quem pode acessar um recurso, função ou dado sensível. O código não verifica permissões corretamente — ou não verifica de jeito nenhum — permitindo que usuários não autorizados realizem ações que deveriam estar restritas.

Example

Um endpoint de API que deleta um cliente valida apenas se o usuário está logado, mas não verifica se ele é admin ou proprietário do cliente. Qualquer usuário autenticado consegue deletar qualquer cliente da plataforma.

How to mitigate

Implemente verificação explícita de permissões antes de toda ação sensível: verifique papel (role), escopo e propriedade do recurso. Use padrões como RBAC ou ABAC e teste casos onde usuários tentam acessar dados alheios.

CVE-2025-43951CRITICALLabVantage before LV 8.8.0.13 HF6 allows local file inclusion. Authenticated users can retrieve arbitrary files from the environment via theEPSS 0.5%CVE-2024-51961HIGHLocal file inclusion (LFI) vulnerability in ArcGIS ServerEPSS 0.5%CVE-2026-61873HIGHGrav before 9.1.8 Arbitrary File Write via Twig-Processed FilenameEPSS 0.5%CVE-2025-9920MEDIUMCampcodes Recruitment Management System index.php include file inclusionEPSS 0.5%CVE-2026-50462HIGHWindows Ancillary Function Driver for WinSock Elevation of Privilege VulnerabilityEPSS 0.5%CVE-2026-20358CRITICALCisco Crosswork Security Hardening Release: August 2026EPSS 0.5%CVE-2025-11451HIGHAuto Amazon Links – Amazon Associates Affiliate Plugin <= 5.4.3 - Unauthenticated Arbitrary File ReadEPSS 0.5%CVE-2026-90932HIGHLaraDashboard 0.9.2 through 1.2.2 Path Traversal RCEEPSS 0.5%CVE-2025-2409HIGHAdmin Authorized System File corruptionEPSS 0.5%CVE-2026-23898HIGHJoomla! Core - [20260305] - Arbitrary file deletion in com_joomlaupdateEPSS 0.5%CVE-2026-53915HIGHIn JetBrains GoLand before 2026.1.3 remote code execution was possible via untrusted project configurationEPSS 0.5%CVE-2025-54162MEDIUMFile Station 5EPSS 0.5%CVE-2026-55699MEDIUMpnpm: reserved bin name deletes PNPM_HOME during global removeEPSS 0.4%CVE-2026-58192HIGHAppium: Unauthenticated arbitrary file/directory deletion in @appium/storage-pluginEPSS 0.4%CVE-2026-85668HIGHXinference 3.3.0 Unauthenticated Arbitrary-Path File Read via /v1/models/llm/auto-registerEPSS 0.4%CVE-2025-48781HIGHSoar Cloud HRD Human Resource Management System - External Control of File Name or PathEPSS 0.4%CVE-2024-9275MEDIUMjeanmarc77 123solar admin_invt2.php file inclusionEPSS 0.4%CVE-2024-33860MEDIUMAn issue was discovered in Logpoint before 7.4.0. It allows Local File Inclusion (LFI) when an arbitrary File Path is used within the File SEPSS 0.4%CVE-2026-26202HIGHPenpot has Arbitrary File Read via create-font-variant RPC endpointEPSS 0.4%CVE-2025-59291HIGHConfidential Azure Container Instances Elevation of Privilege VulnerabilityEPSS 0.4%