Falhas do tipo CWE-73
668 resultadosControle de acesso inadequado
A aplicação falha em validar ou enforçar corretamente quem pode acessar quais recursos ou funcionalidades. Isso permite que usuários não autorizados executem ações, visualizem dados sensíveis ou acessem áreas administrativas que deveriam estar restritas.
Exemplo
Um sistema bancário que valida se o usuário está logado, mas não verifica se ele tem permissão para acessar a conta de outro cliente — bastaria mudar o ID na URL (ex: `/conta/123` para `/conta/456`) para ver dados alheios.
Como mitigar
Implemente verificações de autorização em todas as operações sensíveis, não confie apenas em obscuridade de URLs ou IDs. Use listas de controle de acesso (ACL) ou papéis (RBAC) centralizados, e valide permissões no servidor antes de retornar qualquer dado ou executar ação.
CVE-2026-20175MEDIUMCisco Finesse File Inclusion VulnerabilityEPSS 0.2%CVE-2026-30287HIGHAn arbitrary file overwrite vulnerability in Deep Thought Industries ACE Scanner PDF Scanner v1.4.5 allows attackers to overwrite critical iEPSS 0.2%CVE-2026-5054HIGHNoMachine External Control of File Path Local Privilege Escalation VulnerabilityEPSS 0.2%CVE-2026-12480MEDIUMArbitrary HDF5 File Read via Virtual Dataset Bypass in keras-team/kerasEPSS 0.2%CVE-2025-3033HIGHOpening local .url files could lead to another file being openedEPSS 0.2%CVE-2026-27008MEDIUMOpenClaw hardened the skill download target directory validationEPSS 0.2%CVE-2026-63225MEDIUMRedocly CLI: Path traversal when using `split` commandEPSS 0.2%CVE-2024-33671HIGHAn issue was discovered in Veritas Backup Exec before 22.2 HotFix 917391. The Backup Exec Deduplication Multi-threaded Streaming Agent can bEPSS 0.2%CVE-2026-26158HIGHBusybox: busybox: arbitrary file modification and privilege escalation via unvalidated tar archive entriesEPSS 0.2%CVE-2026-50158HIGHyutu: Arbitrary File Write via MCP `caption-download` ToolEPSS 0.2%CVE-2024-23317MEDIUMExternal Control of File Name or Path (CWE-73) in the Controller 6000 and Controller 7000 allows an attacker with local access to the ControEPSS 0.2%CVE-2026-0965LOWLibssh: libssh: denial of service via improper configuration file handlingEPSS 0.2%CVE-2023-28603HIGHZoom VDI client installer prior to 5.14.0 contains an improper access control vulnerability. A malicious user may potentially delete localEPSS 0.2%CVE-2026-49836MEDIUMpsd-tools: arbitrary file write via smart-object filenameEPSS 0.2%CVE-2026-8921HIGHExternal Control of File Name or Path vulnerability in ASUS Business Manager allows a local user to execute arbitrary code with SYSTEM priviEPSS 0.2%CVE-2026-42881HIGHSTIGQter: Arbitrary File Write leading to Local Code Execution via Export HTMLEPSS 0.2%CVE-2025-64738MEDIUMZoom Workplace for macOS - External Control of File Name or PathEPSS 0.2%CVE-2026-5053HIGHNoMachine External Control of File Path Arbitrary File Deletion VulnerabilityEPSS 0.1%CVE-2026-73770HIGHAuthenticated Arbitrary File Write Vulnerability Leading to Remote Code Execution in AOS-CXEPSS 0.1%CVE-2026-49358LOWPhpWeasyPrint vulnerable to arbitrary file deletion at shutdown via public $temporaryFilesEPSS 0.1%