Weaknesses of type CWE-73

668 results

Controle de acesso impróprio

Ocorre quando a aplicação falha em validar adequadamente quem pode acessar um recurso, função ou dado sensível. O código não verifica permissões corretamente — ou não verifica de jeito nenhum — permitindo que usuários não autorizados realizem ações que deveriam estar restritas.

Example

Um endpoint de API que deleta um cliente valida apenas se o usuário está logado, mas não verifica se ele é admin ou proprietário do cliente. Qualquer usuário autenticado consegue deletar qualquer cliente da plataforma.

How to mitigate

Implemente verificação explícita de permissões antes de toda ação sensível: verifique papel (role), escopo e propriedade do recurso. Use padrões como RBAC ou ABAC e teste casos onde usuários tentam acessar dados alheios.

CVE-2020-2003MEDIUMPAN-OS: Authenticated administrator can delete arbitrary system fileEPSS 0.9%CVE-2023-4191MEDIUMSourceCodester Resort Reservation System index.php file inclusionEPSS 0.9%CVE-2024-25117MEDIUMphp-svg-lib lacks path validation on font through SVG inline styles EPSS 0.9%CVE-2025-48385HIGHGit alllows arbitrary file writes via bundle-uri parameter injectionEPSS 0.9%CVE-2025-71333CRITICALFlowise - Arbitrary File Upload via Unauthenticated /api/v1/attachments EndpointEPSS 0.9%CVE-2026-15307HIGHServer-side file-write and request forgery via spatial lookupsEPSS 0.9%CVE-2020-8553MEDIUMKubernetes ingress-nginx Compromise of auth via subset/superset namespace namesEPSS 0.9%CVE-2024-12066HIGHSMSA Shipping(official) <= 2.3 - Authenticated (Subscriber+) Arbitrary File DeletionEPSS 0.9%CVE-2025-2004CRITICALSimple WP Events <= 1.8.17 - Unauthenticated Arbitrary File DeletionEPSS 0.9%CVE-2026-48753CRITICALIncus has an arbitrary file write via path traversal in S3 multipart uploadEPSS 0.9%CVE-2026-8043CRITICALExternal control of a file name in Ivanti Xtraction before version 2026.2 allows a remote authenticated attacker to read sensitive files andEPSS 0.9%CVE-2024-6829CRITICALArbitrary File Overwrite through tarfile-extraction in aimhubio/aimEPSS 0.9%CVE-2026-53451CRITICALGround Station: Unauthenticated arbitrary file write (path traversal) in save-waterfall-snapshot leads to remote code executionEPSS 0.9%CVE-2023-6618MEDIUMSourceCodester Simple Student Attendance System index.php file inclusionEPSS 0.9%CVE-2026-20931HIGHWindows Telephony Service Elevation of Privilege VulnerabilityEPSS 0.9%CVE-2024-6467HIGHBookingPress Appointment Booking <= 1.1.5 - Authenticated (Subscriber+) Arbitrary File Read to Arbitrary File CreationEPSS 0.9%CVE-2024-27175MEDIUMLocal File InclusionEPSS 0.9%CVE-2023-32615MEDIUMA file write vulnerability exists in the OAS Engine configuration functionality of Open Automation Software OAS Platform v18.00.0072. A specEPSS 0.8%CVE-2025-1686MEDIUMVersions of the package io.pebbletemplates:pebble from 0 and before 4.1.0 are vulnerable to External Control of File Name or Path via the inEPSS 0.8%CVE-2026-69355HIGHMicrosoft Exchange Server Remote Code Execution VulnerabilityEPSS 0.8%