CWE-267 特权定义了不安全动作 类弱点 46 条 CVE 漏洞汇总，含 AI 中文分析。
CWE-267 指权限定义不当漏洞，即赋予实体的权限包含未预期的危险操作。攻击者常利用此缺陷，通过合法身份执行非预期的高危动作，从而绕过安全控制并获取未授权访问。开发者应避免在权限模型中捆绑无关能力，遵循最小权限原则，确保每个角色仅拥有完成其任务所需的最小权限集，并严格审查权限与操作之间的映射关系。
public enum Roles { ADMIN,USER,GUEST } public void printDebugInfo(User requestingUser){ if(isAuthenticated(requestingUser)){ switch(requestingUser.role){ case GUEST: System.out.println("You are not authorized to perform this command"); break; default: System.out.println(currentDebugState()); break; } } else{ System.out.println("You must be logged in to perform this command"); } }| CVE ID | 标题 | CVSS | 风险等级 | Published |
|---|---|---|---|---|
| CVE-2025-36255 | IBM System Storage DS8A00 权限许可和访问控制问题漏洞 — DS8A00( R10.0 - R10.1 ) | 7.5 | High | 2026-08-19 |
| CVE-2026-10090 | Red Hat Advanced Cluster Management for Kubernetes 权限许可和访问控制问题漏洞 — Red Hat Advanced Cluster Management for Kubernetes 2 | 9.0 | Critical | 2026-08-05 |
| CVE-2026-6816 | Drupal TFA Basic Plugins 安全漏洞 — TFA Basic Plugins | - | - | 2026-05-28 |
| CVE-2026-42406 | F5 BIG-IP和F5 BIG-IQ 安全漏洞 — BIG-IP | 6.5 | Medium | 2026-05-13 |
| CVE-2026-27314 | Apache Cassandra 安全漏洞 — Apache Cassandra | 8.8AI | High AI | 2026-04-07 |
| CVE-2026-2460 | Hitachi Energy Relion REB500 安全漏洞 — Relion REB500 | 7.3 | - | 2026-02-24 |
| CVE-2026-2459 | Hitachi Energy Relion REB500 安全漏洞 — Relion REB500 | 7.1 | - | 2026-02-24 |
| CVE-2025-14349 | Universal FlexCity/Kiosk 访问控制错误漏洞 — FlexCity/Kiosk | 8.8 | High | 2026-02-13 |
| CVE-2026-0945 | Drupal Role Delegation 安全漏洞 — Role Delegation | 8.8AI | High AI | 2026-02-04 |
| CVE-2025-13979 | Drupal Mini site 安全漏洞 — Mini site | 5.4AI | Medium AI | 2026-01-28 |
| CVE-2026-23526 | CVAT.ai CVAT 安全漏洞 — cvat | 6.5AI | Medium AI | 2026-01-21 |
| CVE-2025-53900 | Kiteworks Mft 安全漏洞 — security-advisories | 6.5 | Medium | 2025-11-29 |
| CVE-2025-41244 | VMware Tools和VMware Aria Operations 安全漏洞 — VCF operations | 7.8 | High | 2025-09-29 |
| CVE-2025-7691 | GitLab Enterprise Edition 安全漏洞 — GitLab | 6.5 | Medium | 2025-09-26 |
| CVE-2025-26467 | Apache Cassandra 安全漏洞 — Apache Cassandra | 8.8 | - | 2025-08-25 |
| CVE-2025-47811 | Wing FTP Server 安全漏洞 — Wing FTP Server | 4.1 | Medium | 2025-07-10 |
| CVE-2025-7030 | Drupal Two-factor Authentication 安全漏洞 — Two-factor Authentication (TFA) | 8.1AI | High AI | 2025-07-08 |
| CVE-2025-23015 | Apache Cassandra 安全漏洞 — Apache Cassandra | 8.8 | - | 2025-02-04 |
| CVE-2024-7571 | Ivanti Secure Access Client 安全漏洞 — Secure Access Client | 7.8 | High | 2024-11-12 |
| CVE-2024-8539 | Ivanti Secure Access Client 安全漏洞 — Secure Access Client | 7.1 | High | 2024-11-12 |
| CVE-2024-47906 | Ivanti Connect Secure 安全漏洞 — Connect Secure | 7.8 | High | 2024-11-12 |
| CVE-2024-8631 | GitLab 安全漏洞 — GitLab | 5.5 | Medium | 2024-09-12 |
| CVE-2024-20411 | Cisco NX-OS Software 安全漏洞 — Cisco NX-OS Software | 6.7 | Medium | 2024-08-28 |
| CVE-2024-42365 | Asterisk 安全漏洞 — asterisk | 7.4 | High | 2024-08-08 |
| CVE-2024-39866 | Siemens SINEMA Remote Connect 安全漏洞 — SINEMA Remote Connect Server | 8.8 | High | 2024-07-09 |
| CVE-2023-28049 | Dell Command | Monitor 安全漏洞 — Dell Command Monitor (DCM) | 4.7 | Medium | 2024-02-06 |
| CVE-2023-41966 | Sielco Analog FM Transmitters 安全漏洞 — Analog FM transmitter | 6.5 | Medium | 2023-10-26 |
| CVE-2023-43746 | F5 BIG-IP 安全漏洞 — BIG-IP | 8.7 | High | 2023-10-10 |
| CVE-2023-44218 | SonicWALL NetExtender 安全漏洞 — NetExtender | 8.8 | High | 2023-10-03 |
| CVE-2023-32457 | Dell PowerScale OneFS 安全漏洞 — PowerScale OneFS | 7.5 | High | 2023-08-29 |
CWE-267（特权定义了不安全动作） 是常见的弱点类别，本平台收录该类弱点关联的 46 条 CVE 漏洞。