Weaknesses of type CWE-73

668 results

Controle de acesso impróprio

Ocorre quando a aplicação falha em validar adequadamente quem pode acessar um recurso, função ou dado sensível. O código não verifica permissões corretamente — ou não verifica de jeito nenhum — permitindo que usuários não autorizados realizem ações que deveriam estar restritas.

Example

Um endpoint de API que deleta um cliente valida apenas se o usuário está logado, mas não verifica se ele é admin ou proprietário do cliente. Qualquer usuário autenticado consegue deletar qualquer cliente da plataforma.

How to mitigate

Implemente verificação explícita de permissões antes de toda ação sensível: verifique papel (role), escopo e propriedade do recurso. Use padrões como RBAC ou ABAC e teste casos onde usuários tentam acessar dados alheios.

CVE-2023-36019CRITICALMicrosoft Power Platform Connector Spoofing VulnerabilityEPSS 15.8%CVE-2026-44127HIGHLocal File Inclusion (LFI) and Arbitrary File DeletionEPSS 15.7%CVE-2025-0105MEDIUMExpedition: Arbitrary File Deletion VulnerabilityEPSS 13.3%CVE-2026-27825CRITICALMCP Atlassian has an arbitrary file write leading to arbitrary code execution via unconstrained download_path in confluence_download_attachmentEPSS 12.7%CVE-2025-6463HIGHForminator Forms – Contact Form, Payment Form & Custom Form Builder <= 1.44.2 - Unauthenticated Arbitrary File Deletion Triggered via Administrator Form Submission DeletionEPSS 12.7%CVE-2026-21249LOWWindows NTLM Spoofing VulnerabilityEPSS 11.1%CVE-2026-33309CRITICALLangflow has an Arbitrary File Write (RCE) via v2 APIEPSS 11.1%CVE-2022-24900CRITICALAbsolute Path Traversal due to incorrect use of `send_file` call in Piano LED VisualizerEPSS 8.4%CVE-2023-30943MEDIUMMoodle: tinymce loaders susceptible to arbitrary folder creationEPSS 6.6%CVE-2021-24966—Error Log Viewer Plugin <= 1.1.1 - Admin+ Arbitrary File ClearingEPSS 5.2%CVE-2020-1631HIGHOut of Cycle Security Advisory: Junos OS: Security vulnerability in J-Web and web based (HTTP/HTTPS) servicesEPSS 4.8%KEVCVE-2025-71334CRITICALFlowise - Arbitrary File Access via Missing Chat Flow ID ValidationEPSS 4.4%CVE-2025-68478HIGHLangflow Vulnerable to External Control of File Name or PathEPSS 4.1%CVE-2022-2431HIGHDownload Manager <= 3.2.50 - Authenticated (Contributor+) Arbitrary File DeletionEPSS 3.7%CVE-2023-39542HIGHA code execution vulnerability exists in the Javascript saveAs API of Foxit Reader 12.1.3.15356. A specially crafted malformed file can creaEPSS 3.7%CVE-2022-0246—iQ Block Country < 1.2.13 - Admin+ Arbitrary File Deletion via Zip SlipEPSS 3.4%CVE-2026-33476HIGHSiYuan has an Unauthenticated Arbitrary File Read via Path TraversalEPSS 3.3%CVE-2023-29324MEDIUMWindows MSHTML Platform Security Feature Bypass VulnerabilityEPSS 2.9%CVE-2022-32761MEDIUMAn information disclosure vulnerability exists in the aVideoEncoderReceiveImage functionality of WWBN AVideo 11.6 and dev master commit 3f7cEPSS 2.8%CVE-2020-2008HIGHPAN-OS: OS command injection or arbitrary file deletion vulnerabilityEPSS 2.8%