Weaknesses of type CWE-73

668 results

Controle de acesso impróprio

Ocorre quando a aplicação falha em validar adequadamente quem pode acessar um recurso, função ou dado sensível. O código não verifica permissões corretamente — ou não verifica de jeito nenhum — permitindo que usuários não autorizados realizem ações que deveriam estar restritas.

Example

Um endpoint de API que deleta um cliente valida apenas se o usuário está logado, mas não verifica se ele é admin ou proprietário do cliente. Qualquer usuário autenticado consegue deletar qualquer cliente da plataforma.

How to mitigate

Implemente verificação explícita de permissões antes de toda ação sensível: verifique papel (role), escopo e propriedade do recurso. Use padrões como RBAC ou ABAC e teste casos onde usuários tentam acessar dados alheios.

CVE-2026-52680CRITICALApache Kyuubi: REST batch multipart upload path traversal allows controlled file writeEPSS 0.8%CVE-2014-125044MEDIUMsoshtolsus wing-tight index.php file inclusionEPSS 0.8%CVE-2023-1070HIGHExternal Control of File Name or Path in nilsteampassnet/teampassEPSS 0.8%CVE-2014-125059MEDIUMsternenseemann sternenblog main.c blog_index file inclusionEPSS 0.8%CVE-2024-13984CRITICALQi'anxin TianQing Management Center rptsvr Arbitrary File UploadEPSS 0.8%CVE-2025-58762CRITICALTautulli vulnerable to Authenticated Remote Code Execution via write primitive and `Script` notification agentEPSS 0.8%CVE-2025-59244MEDIUMNTLM Hash Disclosure Spoofing VulnerabilityEPSS 0.8%CVE-2025-13320MEDIUMWP User Manager <= 2.9.12 - Authenticated (Subscriber+) Arbitrary File Deletion via 'current_user_avatar' ParameterEPSS 0.8%CVE-2026-48752CRITICALIncus has arbitrary file read+write on host via templates/ symlink in malicious imageEPSS 0.8%CVE-2025-59200HIGHData Sharing Service Spoofing VulnerabilityEPSS 0.8%CVE-2021-4332MEDIUMThe Plus Addons for Elementor PRO <= 4.1.9 & The Plus Addons for Elementor <= 2.0.6 - Authenticated (Contributor+) Arbitrary File ReadEPSS 0.8%CVE-2026-48750CRITICALIncus has an arbitrary file write on host via `exec-output` symlink in crafted imageEPSS 0.8%CVE-2025-66449HIGHConvertX has Path Traversal that leads to Arbitrary File Write and Arbitrary Code ExecutionEPSS 0.8%CVE-2024-2917MEDIUMCampcodes House Rental Management System index.php file inclusionEPSS 0.8%CVE-2026-50006CRITICALAnyquery: Arbitrary File Write (AFW) which could lead to Remote Code Execution (RCE) via Unrestricted ATTACH DATABASE in Server ModeEPSS 0.8%CVE-2025-30201HIGHWazuh NetNTLMv2 Hash Theft In Multiple Centralized Configuration CapabilitiesEPSS 0.8%CVE-2026-6070CRITICALWP-BusinessDirectory <= 4.0.1 - Unauthenticated Arbitrary File Deletion via Path Traversal via '_filename' ParameterEPSS 0.8%CVE-2022-42733HIGHA vulnerability has been identified in syngo Dynamics (All versions < VA40G HF01). syngo Dynamics application server hosts a web service usiEPSS 0.8%CVE-2026-10303HIGHServerCo getssl ACME shell script path injectionEPSS 0.8%CVE-2022-23536MEDIUMAlertmanager can expose local files content via specially crafted configEPSS 0.8%