Weaknesses of type CWE-73

768 results

Controle de acesso impróprio

Ocorre quando a aplicação falha em validar adequadamente quem pode acessar um recurso, função ou dado sensível. O código não verifica permissões corretamente — ou não verifica de jeito nenhum — permitindo que usuários não autorizados realizem ações que deveriam estar restritas.

Example

Um endpoint de API que deleta um cliente valida apenas se o usuário está logado, mas não verifica se ele é admin ou proprietário do cliente. Qualquer usuário autenticado consegue deletar qualquer cliente da plataforma.

How to mitigate

Implemente verificação explícita de permissões antes de toda ação sensível: verifique papel (role), escopo e propriedade do recurso. Use padrões como RBAC ou ABAC e teste casos onde usuários tentam acessar dados alheios.

CVE-2026-20931HIGHWindows Telephony Service Elevation of Privilege VulnerabilityEPSS 0.8%CVE-2026-84374HIGHLaravel Excel writes exports outside the configured filesystem disk when given a caller-controlled pathEPSS 0.8%CVE-2023-1070HIGHExternal Control of File Name or Path in nilsteampassnet/teampassEPSS 0.8%CVE-2026-90932HIGHLaraDashboard 0.9.2 through 1.2.2 Path Traversal RCEEPSS 0.8%CVE-2025-58762CRITICALTautulli vulnerable to Authenticated Remote Code Execution via write primitive and `Script` notification agentEPSS 0.8%CVE-2024-13984CRITICALQi'anxin TianQing Management Center rptsvr Arbitrary File UploadEPSS 0.8%CVE-2025-59244MEDIUMNTLM Hash Disclosure Spoofing VulnerabilityEPSS 0.8%CVE-2022-23536MEDIUMAlertmanager can expose local files content via specially crafted configEPSS 0.8%CVE-2025-13320MEDIUMWP User Manager <= 2.9.12 - Authenticated (Subscriber+) Arbitrary File Deletion via 'current_user_avatar' ParameterEPSS 0.8%CVE-2026-88899CRITICALknowns before 0.31.0 External Control of Agent Working Directory via x-opencode-directory HeaderEPSS 0.8%CVE-2025-30201HIGHWazuh NetNTLMv2 Hash Theft In Multiple Centralized Configuration CapabilitiesEPSS 0.8%CVE-2025-59200HIGHData Sharing Service Spoofing VulnerabilityEPSS 0.8%CVE-2026-64679HIGHAtlantis: Path Traversal in Atlantis Workspace Handling Allows Out-of-Bounds Directory Deletion/CreationEPSS 0.8%CVE-2021-4332MEDIUMThe Plus Addons for Elementor PRO <= 4.1.9 & The Plus Addons for Elementor <= 2.0.6 - Authenticated (Contributor+) Arbitrary File ReadEPSS 0.8%CVE-2026-17482CRITICALIBM Documentation Offline is vulnerable to information disclosure, session forgery and remote code executionEPSS 0.8%CVE-2026-17184CRITICALIBM Db2 Mirror for i is affected by multiple vulnerabilitiesEPSS 0.8%CVE-2026-106042CRITICALAn External Control of File Name or Path vulnerability in Ivanti Xtraction before version 2026.4 allows a remote authenticated attacker to rEPSS 0.8%CVE-2022-42733HIGHA vulnerability has been identified in syngo Dynamics (All versions < VA40G HF01). syngo Dynamics application server hosts a web service usiEPSS 0.8%CVE-2025-66449HIGHConvertX has Path Traversal that leads to Arbitrary File Write and Arbitrary Code ExecutionEPSS 0.8%CVE-2026-48752CRITICALIncus has arbitrary file read+write on host via templates/ symlink in malicious imageEPSS 0.8%