Weaknesses of type CWE-73

768 results

Controle de acesso impróprio

Ocorre quando a aplicação falha em validar adequadamente quem pode acessar um recurso, função ou dado sensível. O código não verifica permissões corretamente — ou não verifica de jeito nenhum — permitindo que usuários não autorizados realizem ações que deveriam estar restritas.

Example

Um endpoint de API que deleta um cliente valida apenas se o usuário está logado, mas não verifica se ele é admin ou proprietário do cliente. Qualquer usuário autenticado consegue deletar qualquer cliente da plataforma.

How to mitigate

Implemente verificação explícita de permissões antes de toda ação sensível: verifique papel (role), escopo e propriedade do recurso. Use padrões como RBAC ou ABAC e teste casos onde usuários tentam acessar dados alheios.

CVE-2019-3681HIGHosc: stores downloaded (supposed) RPM in network-controlled filesystem pathsEPSS 1.4%CVE-2026-11526CRITICALGD versions before 2.86 for Perl allow OS command injection and file overwrite via a 2-arg open() of filename arguments in _make_filehandleEPSS 1.4%CVE-2024-27945HIGHA vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V5.5). The bulk import feature of the affected systems allow a priEPSS 1.4%CVE-2025-24996MEDIUMNTLM Hash Disclosure Spoofing VulnerabilityEPSS 1.3%CVE-2024-38165MEDIUMWindows Compressed Folder Tampering VulnerabilityEPSS 1.3%CVE-2023-0003MEDIUMCortex XSOAR: Local File Disclosure Vulnerability in the Cortex XSOAR ServerEPSS 1.3%CVE-2023-49738HIGHAn information disclosure vulnerability exists in the image404Raw.php functionality of WWBN AVideo dev master commit 15fed957fb. A speciallyEPSS 1.3%CVE-2021-3845—External Control of File Name or Path in netristv/ws-scrcpyEPSS 1.3%CVE-2025-26646HIGH.NET, Visual Studio, and Build Tools for Visual Studio Spoofing VulnerabilityEPSS 1.3%CVE-2024-27943HIGHA vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V5.5). The affected systems allow a privileged user to upload geneEPSS 1.3%CVE-2024-43615HIGHMicrosoft OpenSSH for Windows Remote Code Execution VulnerabilityEPSS 1.2%CVE-2022-2400MEDIUMExternal Control of File Name or Path in dompdf/dompdfEPSS 1.2%CVE-2022-2638—Export All URLs < 4.4 - Admin+ Arbitrary System File RemovalEPSS 1.2%CVE-2020-5297LOWUpload whitelisted files to any directory in OctoberCMSEPSS 1.2%CVE-2023-2152MEDIUMSourceCodester Student Study Center Desk Management System index.php file inclusionEPSS 1.2%CVE-2025-71338CRITICALFlowise through 2.2.7 - Arbitrary File Write to Remote Code Execution via document-store APIEPSS 1.2%CVE-2021-38477CRITICALAUVESY VersiondogEPSS 1.2%CVE-2020-9752—Naver Cloud Explorer before 2.2.2.11 allows the attacker can move a local file in any path on the filesystem as a system privilege through iEPSS 1.1%CVE-2025-59185MEDIUMNTLM Hash Disclosure Spoofing VulnerabilityEPSS 1.1%CVE-2026-15307HIGHServer-side file-write and request forgery via spatial lookupsEPSS 1.1%