Falhas do tipo CWE-73
668 resultadosControle de acesso inadequado
A aplicação falha em validar ou enforçar corretamente quem pode acessar quais recursos ou funcionalidades. Isso permite que usuários não autorizados executem ações, visualizem dados sensíveis ou acessem áreas administrativas que deveriam estar restritas.
Exemplo
Um sistema bancário que valida se o usuário está logado, mas não verifica se ele tem permissão para acessar a conta de outro cliente — bastaria mudar o ID na URL (ex: `/conta/123` para `/conta/456`) para ver dados alheios.
Como mitigar
Implemente verificações de autorização em todas as operações sensíveis, não confie apenas em obscuridade de URLs ou IDs. Use listas de controle de acesso (ACL) ou papéis (RBAC) centralizados, e valide permissões no servidor antes de retornar qualquer dado ou executar ação.
CVE-2026-82393HIGHpnpm: A tarball dependency's manifest `name` escapes node_modules → arbitrary file write/overwrite on installEPSS 0.4%CVE-2025-11738MEDIUMMedia Library Assistant <= 3.29 - Unauthenticated Limited File ReadEPSS 0.4%CVE-2026-77176HIGHKata-containers: insufficient validation of createcontainer mount and storage rules in genpolicyEPSS 0.4%CVE-2025-1911LOWProduct Import Export for WooCommerce <= 2.5.0 - Directory Traversal to Authenticated (Administrator+) Limited Arbitrary File Deletion via admin_log_page FunctionEPSS 0.4%CVE-2026-28286HIGHZimaOS: Unauthorized Creation of Files/Folders in Restricted System Directories via APIEPSS 0.4%CVE-2026-34522HIGHSillyTavern: Path traversal in `/api/chats/import` allows arbitrary file write outside intended chat directoryEPSS 0.4%CVE-2026-53648MEDIUMFOSSBilling: Downloadable product files can be overwritten through filename collisionsEPSS 0.4%CVE-2025-35053MEDIUMNewforma Info Exchange (NIX) arbitrary file read and deleteEPSS 0.4%CVE-2026-86189CRITICALWWBN AVideo Unauthenticated Path Traversal via notify.ffmpeg.json.phpEPSS 0.4%CVE-2025-3431HIGHZoomSounds - WordPress Wave Audio Player with Playlist <= 6.91 - Unauthenticated Arbitrary File DownloadEPSS 0.4%CVE-2026-59194HIGHpnpm: patch-remove could delete project-selected files outside the patches directoryEPSS 0.4%CVE-2026-59196HIGHpnpm: hoisted install imports lockfile alias outside node_modulesEPSS 0.4%CVE-2026-85603HIGHGrav Admin Plugin Path Traversal via Save As Language CodeEPSS 0.4%CVE-2026-30893CRITICALWazuh cluster sync path traversal in decompress_files() enables arbitrary file write and code execution from authenticated cluster peerEPSS 0.4%CVE-2025-53769MEDIUMWindows Security App Spoofing VulnerabilityEPSS 0.4%CVE-2026-33027MEDIUMNginx UI: Improper Path Validation Allows Recursive Deletion of the Nginx Configuration DirectoryEPSS 0.4%CVE-2024-47265MEDIUMImproper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability in encrypted share umount functionality in SynoEPSS 0.4%CVE-2025-1972LOWExport and Import Users and Customers <= 2.6.2 - Directory Traversal to Authenticated (Administrator+) Limited Arbitrary File Deletion via admin_log_page FunctionEPSS 0.4%CVE-2024-13922LOWOrder Export & Order Import for WooCommerce <= 2.6.0 - Directory Traversal to Authenticated (Administrator+) Limited Arbitrary File Deletion via admin_log_page FunctionEPSS 0.4%CVE-2025-3103HIGHCLEVER - HTML5 Radio Player With History - Shoutcast and Icecast - Elementor Widget Addon <= 2.4 - Unauthenticated Arbitrary File ReadEPSS 0.4%