CWE-266 特权授予不正确 类弱点 510 条 CVE 漏洞汇总，含 AI 中文分析。
CWE-266属于权限分配错误漏洞，指软件将特权错误地授予特定主体，导致其获得非预期的控制范围。攻击者通常利用此缺陷，通过身份伪造或会话劫持等手段，以低权限身份获取高权限操作能力，从而执行未授权行为。开发者应避免在代码中硬编码权限逻辑，采用基于角色的访问控制（RBAC）机制，并在每次权限检查时动态验证主体身份与权限的匹配性，确保最小权限原则。
seteuid(0); /* do some stuff */ seteuid(getuid());AccessController.doPrivileged(new PrivilegedAction() { public Object run() { // privileged code goes here, for example: System.loadLibrary("awt"); return null; // nothing to return }| CVE ID | 标题 | CVSS | 风险等级 | Published |
|---|---|---|---|---|
| CVE-2026-62106 | WordPress SMS 插件 3.9.9 权限提升漏洞 — SMS Alert Order Notifications | 8.8 | High | 2026-09-11 |
| CVE-2026-62102 | WordPress Gato GraphQL 插件权限提升漏洞 — Gato GraphQL | 8.8 | High | 2026-09-11 |
| CVE-2026-8303 | Pardus 软件权限提升漏洞 — Pardus-software | 7.8 | High | 2026-09-11 |
| CVE-2026-81805 | WordPress SiteSkite 2.1.5 权限提升漏洞 — SiteSkite | 8.1 | High | 2026-09-10 |
| CVE-2026-15140 | Portworx Operator在OpenShift上的权限提升漏洞 — Portworx Operator | 7.7 | High | 2026-09-09 |
| CVE-2026-77654 | Horizon Security Analyzer 本地权限提升漏洞 — Horizon Security Analyzer | 6.1 | Medium | 2026-09-08 |
| CVE-2026-81792 | WordPress WooCommerce插件6.1.4权限提升漏洞 — Product Catalog Enquiry for WooCommerce by MultiVendorX | 6.5 | Medium | 2026-09-08 |
| CVE-2026-86500 | JetBrains YouTrack 权限许可和访问控制问题漏洞 — YouTrack | 5.5 | Medium | 2026-09-07 |
| CVE-2026-86482 | JetBrains YouTrack 权限许可和访问控制问题漏洞 — YouTrack | 8.8 | High | 2026-09-07 |
| CVE-2026-84814 | Bricksforge 权限许可和访问控制问题漏洞 — Bricksforge | 9.8 | Critical | 2026-09-03 |
| CVE-2026-84756 | WordPress WCFM Membership 权限许可和访问控制问题漏洞 — WCFM Membership | 7.1 | High | 2026-09-03 |
| CVE-2026-81294 | WordPress Authorizer 权限许可和访问控制问题漏洞 — Authorizer | 9.8 | Critical | 2026-09-02 |
| CVE-2026-81769 | LiquidThemes Booking Hub 权限许可和访问控制问题漏洞 — Booking Hub | 8.8 | High | 2026-09-02 |
| CVE-2026-84807 | Kimai 权限许可和访问控制问题漏洞 — kimai | 5.4 | Medium | 2026-09-02 |
| CVE-2026-81297 | wpmanageninja Fluent Forms Pro Add On Pack 权限许可和访问控制问题漏洞 — Fluent Forms Pro Add On Pack | 7.5 | High | 2026-08-31 |
| CVE-2026-78271 | WordPress FluentCRM Pro 权限许可和访问控制问题漏洞 — FluentCRM Pro | 7.2 | High | 2026-08-27 |
| CVE-2026-32566 | ACPT Custom Post Types Plugin for WordPress 权限许可和访问控制问题漏洞 — ACPT (Pro) - Custom Post Types Plugin for WordPress | 9.8 | Critical | 2026-08-27 |
| CVE-2026-78267 | WordPress TranslatePress 权限许可和访问控制问题漏洞 — TranslatePress | 9.8 | Critical | 2026-08-24 |
| CVE-2026-32561 | LiquidThemes Booking Hub 权限许可和访问控制问题漏洞 — Booking Hub | 8.8 | High | 2026-08-24 |
| CVE-2026-21756 | HCL Hive 权限许可和访问控制问题漏洞 — HCL Hive | 7.2 | High | 2026-08-24 |
| CVE-2026-66648 | mvpthemes Jawn 权限许可和访问控制问题漏洞 — Jawn | 9.8 | Critical | 2026-08-24 |
| CVE-2026-32558 | Affiliate-Pro 权限许可和访问控制问题漏洞 — Affiliate Pro - Affiliate Program for WooCommerce & WordPress | 9.8 | Critical | 2026-08-24 |
| CVE-2026-28165 | Digits 权限许可和访问控制问题漏洞 — Digits | 9.8 | Critical | 2026-08-24 |
| CVE-2026-75910 | Amazon Athena Query Federation 权限许可和访问控制问题漏洞 — Athena Federated Query Clickhouse Connector deployment template | 6.5 | Medium | 2026-08-20 |
| CVE-2026-66682 | WooCommerce Abandoned Cart Pro 权限许可和访问控制问题漏洞 — Abandoned Cart Pro for WooCommerce | 9.8 | Critical | 2026-08-20 |
| CVE-2025-15689 | WordPress Capella 权限许可和访问控制问题漏洞 — Capella | 9.8 | Critical | 2026-08-20 |
| CVE-2026-11861 | FreeIPA 权限许可和访问控制问题漏洞 — Red Hat Enterprise Linux 10 | 9.6 | Critical | 2026-08-20 |
| CVE-2026-73390 | WordPress Total Donations 权限许可和访问控制问题漏洞 — Total Donations | 9.8 | Critical | 2026-08-19 |
| CVE-2026-73347 | WordPress TrueBooker 权限许可和访问控制问题漏洞 — TrueBooker | 9.8 | Critical | 2026-08-19 |
| CVE-2026-73350 | PSM Plugins SupportCandy 权限许可和访问控制问题漏洞 — SupportCandy | 8.2 | High | 2026-08-18 |
CWE-266（特权授予不正确） 是常见的弱点类别，本平台收录该类弱点关联的 510 条 CVE 漏洞。