Weaknesses of type CWE-73

768 results

Controle de acesso impróprio

Ocorre quando a aplicação falha em validar adequadamente quem pode acessar um recurso, função ou dado sensível. O código não verifica permissões corretamente — ou não verifica de jeito nenhum — permitindo que usuários não autorizados realizem ações que deveriam estar restritas.

Example

Um endpoint de API que deleta um cliente valida apenas se o usuário está logado, mas não verifica se ele é admin ou proprietário do cliente. Qualquer usuário autenticado consegue deletar qualquer cliente da plataforma.

How to mitigate

Implemente verificação explícita de permissões antes de toda ação sensível: verifique papel (role), escopo e propriedade do recurso. Use padrões como RBAC ou ABAC e teste casos onde usuários tentam acessar dados alheios.

CVE-2020-2008HIGHPAN-OS: OS command injection or arbitrary file deletion vulnerabilityEPSS 2.8%CVE-2022-28710MEDIUMAn information disclosure vulnerability exists in the chunkFile functionality of WWBN AVideo 11.6 and dev master commit 3f7c0364. A speciallEPSS 2.7%CVE-2023-35985HIGHAn arbitrary file creation vulnerability exists in the Javascript exportDataObject API of Foxit Reader 12.1.3.15356 due to a failure to propEPSS 2.7%CVE-2025-59516HIGHWindows Storage VSP Driver Elevation of Privilege VulnerabilityEPSS 2.3%CVE-2014-2375—Ecava IntegraXor SCADA Server External Control of File Name or PathEPSS 2.3%CVE-2018-14820—Advantech WebAccess 8.3.1 and earlier has a .dll component that is susceptible to external control of file name or path vulnerability, whichEPSS 2.2%CVE-2025-68428CRITICALjsPDF has Local File Inclusion/Path Traversal vulnerabilityEPSS 2.2%CVE-2026-92193MEDIUMQuest Foglight for Databases FileServlet External Control of File Path Information Disclosure VulnerabilityEPSS 2.1%CVE-2018-7495—In Advantech WebAccess versions V8.2_20170817 and prior, WebAccess versions V8.3.0 and prior, WebAccess Dashboard versions V.2.0.15 and prioEPSS 2.1%CVE-2023-36764HIGHMicrosoft SharePoint Server Elevation of Privilege VulnerabilityEPSS 2.1%CVE-2020-6105HIGHAn exploitable code execution vulnerability exists in the multiple devices functionality of F2fs-Tools F2fs.Fsck 1.13. A specially crafted fEPSS 2.1%CVE-2024-20652HIGHWindows HTML Platforms Security Feature Bypass VulnerabilityEPSS 2.1%CVE-2024-5334HIGHLocal File Read in stitionai/devikaEPSS 2.1%CVE-2023-40194HIGHAn arbitrary file creation vulnerability exists in the Javascript exportDataObject API of Foxit Reader 12.1.3.15356 due to mistreatment of wEPSS 2.0%CVE-2025-0111HIGHPAN-OS: Authenticated File Read Vulnerability in the Management Web InterfaceEPSS 2.0%KEVCVE-2020-2009HIGHPAN-OS: Panorama SD WAN arbitrary file creationEPSS 2.0%CVE-2026-96656HIGHPlex Media Server arbitrary file writeEPSS 1.8%KEVCVE-2025-59049HIGHMockoon has a Path Traversal and LFI in the static file serving endpointEPSS 1.8%CVE-2023-46851—Apache Allura: sensitive information exposure via importEPSS 1.6%CVE-2025-46762HIGHApache Parquet Java: Potential malicious code execution from trusted packages in the parquet-avro module when reading an Avro schema from a Parquet file metadataEPSS 1.6%