Falhas do tipo CWE-73
668 resultadosControle de acesso inadequado
A aplicação falha em validar ou enforçar corretamente quem pode acessar quais recursos ou funcionalidades. Isso permite que usuários não autorizados executem ações, visualizem dados sensíveis ou acessem áreas administrativas que deveriam estar restritas.
Exemplo
Um sistema bancário que valida se o usuário está logado, mas não verifica se ele tem permissão para acessar a conta de outro cliente — bastaria mudar o ID na URL (ex: `/conta/123` para `/conta/456`) para ver dados alheios.
Como mitigar
Implemente verificações de autorização em todas as operações sensíveis, não confie apenas em obscuridade de URLs ou IDs. Use listas de controle de acesso (ACL) ou papéis (RBAC) centralizados, e valide permissões no servidor antes de retornar qualquer dado ou executar ação.
CVE-2026-52875HIGHStreambert: Arbitrary Directory Creation and File Manipulation via Backup HandlerEPSS 0.2%CVE-2025-32802MEDIUMInsecure handling of file paths allows multiple local attacksEPSS 0.2%CVE-2026-58484HIGHNetwork-AI: Poisoned environment backup manifest allows arbitrary recursive deletion during backup pruningEPSS 0.2%CVE-2026-30284HIGHAn arbitrary file overwrite vulnerability in UXGROUP LLC Voice Recorder v10.0 allows attackers to overwrite critical internal files via the EPSS 0.2%CVE-2026-53449MEDIUMCoturn: Arbitrary File Write via CLI psd CommandEPSS 0.2%CVE-2026-30289HIGHAn arbitrary file overwrite vulnerability in Tinybeans Private Family Album App v5.9.5-prod allows attackers to overwrite critical internal EPSS 0.2%CVE-2024-20366HIGHA vulnerability in the Tail-f High Availability Cluster Communications (HCC) function pack of Cisco Crosswork Network Services Orchestrator EPSS 0.2%CVE-2026-82194MEDIUMWPvivid Backup & Migration < 0.9.134 - Admin+ Arbitrary File Deletion via Path TraversalEPSS 0.2%CVE-2026-47425MEDIUMRattler vulnerable to entry-point path traversal in noarch:python install (arbitrary file write)EPSS 0.2%CVE-2026-92595MEDIUMNodemailer before 9.1.1 Security Sandbox Bypass via resolveContentEPSS 0.2%CVE-2026-17014MEDIUMWP Photo Album Plus < 9.2.07.002 - Unauthenticated Export ZIP File Deletion via delexportzipsEPSS 0.2%CVE-2026-52872HIGHStreambert: Local File Exfiltration and Overwrite via Subtitle file: ProtocolEPSS 0.2%CVE-2026-2604MEDIUMEvolution-data-server: evolution data server: arbitrary file deletion via inconsistent uri handlingEPSS 0.2%CVE-2025-36398MEDIUMDS8900F and DS8A00 Information DisclosureEPSS 0.2%CVE-2025-27137MEDIUMDependency-Track vulnerable to local file inclusion via custom notification templatesEPSS 0.2%CVE-2026-13748MEDIUMSnowflake CLI Arbitrary Local File Read and Exfiltration Through Improper File Path RestrictionEPSS 0.2%CVE-2026-42424MEDIUMOpenClaw < 2026.4.8 - Local File Exfiltration via Shared Reply MEDIA PathsEPSS 0.2%CVE-2026-20175MEDIUMCisco Finesse File Inclusion VulnerabilityEPSS 0.2%CVE-2026-77006CRITICALWebTotem Backups < 1.1.0 - Subscriber+ Arbitrary File Deletion via Path TraversalEPSS 0.2%CVE-2023-20234MEDIUMA vulnerability in the CLI of Cisco FXOS Software could allow an authenticated, local attacker to create a file or overwrite any file on theEPSS 0.2%