Falhas do tipo CWE-73
665 resultadosControle de acesso inadequado
A aplicação falha em validar ou enforçar corretamente quem pode acessar quais recursos ou funcionalidades. Isso permite que usuários não autorizados executem ações, visualizem dados sensíveis ou acessem áreas administrativas que deveriam estar restritas.
Exemplo
Um sistema bancário que valida se o usuário está logado, mas não verifica se ele tem permissão para acessar a conta de outro cliente — bastaria mudar o ID na URL (ex: `/conta/123` para `/conta/456`) para ver dados alheios.
Como mitigar
Implemente verificações de autorização em todas as operações sensíveis, não confie apenas em obscuridade de URLs ou IDs. Use listas de controle de acesso (ACL) ou papéis (RBAC) centralizados, e valide permissões no servidor antes de retornar qualquer dado ou executar ação.
CVE-2023-36019CRITICALMicrosoft Power Platform Connector Spoofing VulnerabilityEPSS 15.8%CVE-2026-44127HIGHLocal File Inclusion (LFI) and Arbitrary File DeletionEPSS 15.7%CVE-2025-0105MEDIUMExpedition: Arbitrary File Deletion VulnerabilityEPSS 13.3%CVE-2026-27825CRITICALMCP Atlassian has an arbitrary file write leading to arbitrary code execution via unconstrained download_path in confluence_download_attachmentEPSS 12.7%CVE-2025-6463HIGHForminator Forms – Contact Form, Payment Form & Custom Form Builder <= 1.44.2 - Unauthenticated Arbitrary File Deletion Triggered via Administrator Form Submission DeletionEPSS 12.7%CVE-2026-21249LOWWindows NTLM Spoofing VulnerabilityEPSS 11.1%CVE-2026-33309CRITICALLangflow has an Arbitrary File Write (RCE) via v2 APIEPSS 11.1%CVE-2022-24900CRITICALAbsolute Path Traversal due to incorrect use of `send_file` call in Piano LED VisualizerEPSS 8.4%CVE-2023-30943MEDIUMMoodle: tinymce loaders susceptible to arbitrary folder creationEPSS 6.6%CVE-2021-24966—Error Log Viewer Plugin <= 1.1.1 - Admin+ Arbitrary File ClearingEPSS 5.2%CVE-2020-1631HIGHOut of Cycle Security Advisory: Junos OS: Security vulnerability in J-Web and web based (HTTP/HTTPS) servicesEPSS 4.8%KEVCVE-2025-71334CRITICALFlowise - Arbitrary File Access via Missing Chat Flow ID ValidationEPSS 4.4%CVE-2025-68478HIGHLangflow Vulnerable to External Control of File Name or PathEPSS 4.1%CVE-2022-2431HIGHDownload Manager <= 3.2.50 - Authenticated (Contributor+) Arbitrary File DeletionEPSS 3.7%CVE-2023-39542HIGHA code execution vulnerability exists in the Javascript saveAs API of Foxit Reader 12.1.3.15356. A specially crafted malformed file can creaEPSS 3.7%CVE-2022-0246—iQ Block Country < 1.2.13 - Admin+ Arbitrary File Deletion via Zip SlipEPSS 3.4%CVE-2026-33476HIGHSiYuan has an Unauthenticated Arbitrary File Read via Path TraversalEPSS 3.3%CVE-2023-29324MEDIUMWindows MSHTML Platform Security Feature Bypass VulnerabilityEPSS 2.9%CVE-2022-32761MEDIUMAn information disclosure vulnerability exists in the aVideoEncoderReceiveImage functionality of WWBN AVideo 11.6 and dev master commit 3f7cEPSS 2.8%CVE-2020-2008HIGHPAN-OS: OS command injection or arbitrary file deletion vulnerabilityEPSS 2.8%