Falhas do tipo CWE-73
668 resultadosControle de acesso inadequado
A aplicação falha em validar ou enforçar corretamente quem pode acessar quais recursos ou funcionalidades. Isso permite que usuários não autorizados executem ações, visualizem dados sensíveis ou acessem áreas administrativas que deveriam estar restritas.
Exemplo
Um sistema bancário que valida se o usuário está logado, mas não verifica se ele tem permissão para acessar a conta de outro cliente — bastaria mudar o ID na URL (ex: `/conta/123` para `/conta/456`) para ver dados alheios.
Como mitigar
Implemente verificações de autorização em todas as operações sensíveis, não confie apenas em obscuridade de URLs ou IDs. Use listas de controle de acesso (ACL) ou papéis (RBAC) centralizados, e valide permissões no servidor antes de retornar qualquer dado ou executar ação.
CVE-2020-2003MEDIUMPAN-OS: Authenticated administrator can delete arbitrary system fileEPSS 0.9%CVE-2023-4191MEDIUMSourceCodester Resort Reservation System index.php file inclusionEPSS 0.9%CVE-2024-25117MEDIUMphp-svg-lib lacks path validation on font through SVG inline styles EPSS 0.9%CVE-2025-48385HIGHGit alllows arbitrary file writes via bundle-uri parameter injectionEPSS 0.9%CVE-2025-71333CRITICALFlowise - Arbitrary File Upload via Unauthenticated /api/v1/attachments EndpointEPSS 0.9%CVE-2026-15307HIGHServer-side file-write and request forgery via spatial lookupsEPSS 0.9%CVE-2020-8553MEDIUMKubernetes ingress-nginx Compromise of auth via subset/superset namespace namesEPSS 0.9%CVE-2024-12066HIGHSMSA Shipping(official) <= 2.3 - Authenticated (Subscriber+) Arbitrary File DeletionEPSS 0.9%CVE-2025-2004CRITICALSimple WP Events <= 1.8.17 - Unauthenticated Arbitrary File DeletionEPSS 0.9%CVE-2026-48753CRITICALIncus has an arbitrary file write via path traversal in S3 multipart uploadEPSS 0.9%CVE-2026-8043CRITICALExternal control of a file name in Ivanti Xtraction before version 2026.2 allows a remote authenticated attacker to read sensitive files andEPSS 0.9%CVE-2024-6829CRITICALArbitrary File Overwrite through tarfile-extraction in aimhubio/aimEPSS 0.9%CVE-2026-53451CRITICALGround Station: Unauthenticated arbitrary file write (path traversal) in save-waterfall-snapshot leads to remote code executionEPSS 0.9%CVE-2023-6618MEDIUMSourceCodester Simple Student Attendance System index.php file inclusionEPSS 0.9%CVE-2026-20931HIGHWindows Telephony Service Elevation of Privilege VulnerabilityEPSS 0.9%CVE-2024-6467HIGHBookingPress Appointment Booking <= 1.1.5 - Authenticated (Subscriber+) Arbitrary File Read to Arbitrary File CreationEPSS 0.9%CVE-2024-27175MEDIUMLocal File InclusionEPSS 0.9%CVE-2023-32615MEDIUMA file write vulnerability exists in the OAS Engine configuration functionality of Open Automation Software OAS Platform v18.00.0072. A specEPSS 0.8%CVE-2025-1686MEDIUMVersions of the package io.pebbletemplates:pebble from 0 and before 4.1.0 are vulnerable to External Control of File Name or Path via the inEPSS 0.8%CVE-2026-69355HIGHMicrosoft Exchange Server Remote Code Execution VulnerabilityEPSS 0.8%