目标达成 感谢每一位支持者 — 我们达成了 100% 目标！

目标: 1000 元 · 已筹: 1336 元

100%
请我们喝杯咖啡

CWE-269 特权管理不恰当 类漏洞列表 1129

CWE-269 特权管理不恰当 类弱点 1129 条 CVE 漏洞汇总，含 AI 中文分析。

CWE-269 属于权限管理不当漏洞，指产品未能正确分配、修改、跟踪或检查用户权限，导致攻击者获得非预期的控制范围。攻击者常利用此缺陷提升权限或越权访问敏感资源。开发者应实施最小权限原则，严格验证每次操作的身份与权限，确保权限分配、变更及撤销过程的安全性与完整性，从而防止未授权访问。

MITRE CWE 官方描述
CWE：CWE-269 权限管理不当 英文：产品未正确分配、修改、跟踪或检查某行为者（actor）的权限，从而为该行为者创建了一个非预期的控制范围。
常见影响 (1)
Access ControlGain Privileges or Assume Identity
缓解措施 (3)
Architecture and Design, OperationVery carefully manage the setting, management, and handling of privileges. Explicitly manage trust zones in the software.
Architecture and DesignFollow the principle of least privilege when assigning access rights to entities in a software system.
Architecture and DesignConsider following the principle of separation of privilege. Require multiple conditions to be met before permitting access to a system resource.
代码示例 (2)
This code temporarily raises the program's privileges to allow creation of a new user folder.
def makeNewUserDir(username): if invalidUsername(username): #avoid CWE-22 and CWE-78 print('Usernames cannot contain invalid characters') return False try: raisePrivileges() os.mkdir('/home/' + username) lowerPrivileges() except OSError: print('Unable to create new user directory for user:' + username) return False return True
Bad · Python
The following example demonstrates the weakness.
seteuid(0); /* do some stuff */ seteuid(getuid());
Bad · C
CVE ID标题CVSS风险等级Published
CVE-2026-12502 Loytec LINX固件ltsudo提权漏洞 — LIP-ME20xC 8.4 High2026-07-24
CVE-2026-16743 Accountsservice任意文件读取漏洞 — Red Hat Enterprise Linux 10 5.5 Medium2026-07-24
CVE-2026-10610 ESET macOS 安全应用程序本地提权漏洞 — ESET Endpoint Security for macOS 8.5 High2026-07-24
CVE-2026-7483 ESET macOS安全应用本地提权漏洞 — ESET Endpoint Security for macOS 8.5 High2026-07-24
CVE-2026-12736 WPify Woo ≤5.4.16 管理员权限提升漏洞 — WPify Woo – Withdrawal, CRN/VAT, QR payments, Heureka and more for WooCommerce 8.0 High2026-07-24
CVE-2026-16764 OWASP DefectDojo 权限许可和访问控制问题漏洞 — DefectDojo 6.3 Medium2026-07-23
CVE-2026-65897 Grav 权限许可和访问控制问题漏洞 — grav 8.8 High2026-07-23
CVE-2026-15017 WordPress MDJM Event Management 权限许可和访问控制问题漏洞 — MDJM Event Management 8.8 High2026-07-23
CVE-2026-16607 Fujitsu Linux openFT 权限许可和访问控制问题漏洞 — Linux openFT 7.8 High2026-07-22
CVE-2026-62145 Check Point Security Management Server 权限许可和访问控制问题漏洞 — Quantum Security Gateway 7.5 High2026-07-22
CVE-2026-65603 Grav 权限许可和访问控制问题漏洞 — grav 8.8 High2026-07-22
CVE-2026-65595 n8n 权限许可和访问控制问题漏洞 — n8n 8.9 High2026-07-22
CVE-2026-47416 MervinPraison PraisonAI 权限许可和访问控制问题漏洞 — praisonai-platform 9.6 Critical2026-07-21
CVE-2026-47413 MervinPraison PraisonAI 权限许可和访问控制问题漏洞 — praisonai-platform 9.6 Critical2026-07-21
CVE-2026-47412 MervinPraison PraisonAI 权限许可和访问控制问题漏洞 — praisonai-platform 8.1 High2026-07-21
CVE-2026-47411 MervinPraison PraisonAI 权限许可和访问控制问题漏洞 — praisonai-platform 6.5 Medium2026-07-21
CVE-2026-47409 MervinPraison PraisonAI 权限许可和访问控制问题漏洞 — praisonai-platform 8.1 High2026-07-21
CVE-2026-47407 MervinPraison PraisonAI 权限许可和访问控制问题漏洞 — praisonai-platform--2026-07-21
CVE-2026-13439 WordPress Easy Form Builder by WhiteStudio – Drag & Drop Form Builder 权限许可和访问控制问题漏洞 — Easy Form Builder by WhiteStudio – Drag & Drop Form Builder 9.8 Critical2026-07-21
CVE-2026-55550 pdovhomilja nextcrm-app 权限许可和访问控制问题漏洞 — nextcrm-app 7.1 High2026-07-20
CVE-2026-16337 DotCMS 权限许可和访问控制问题漏洞 — dotCMS--2026-07-20
CVE-2026-62183 Apache Syncope 权限许可和访问控制问题漏洞 — Apache Syncope--2026-07-20
CVE-2026-47870 VMware Avi Load Balancer 权限许可和访问控制问题漏洞 — Avi Load Balancer 7.1 High2026-07-18
CVE-2026-47868 VMware Avi Load Balancer 权限许可和访问控制问题漏洞 — Avi Load Balancer 7.8 High2026-07-18
CVE-2026-48010 Shopware 权限许可和访问控制问题漏洞 — shopware 6.5 Medium2026-07-17
CVE-2026-15982 WordPress Aimogen Pro 权限许可和访问控制问题漏洞 — Aimogen Pro - All-in-One AI Content Writer, Editor, ChatBot & Automation Toolkit 9.8 Critical2026-07-17
CVE-2026-14956 Bricksforge 权限许可和访问控制问题漏洞 — Bricksforge 9.8 Critical2026-07-17
CVE-2026-43978 wger 权限许可和访问控制问题漏洞 — wger 8.1 High2026-07-16
CVE-2026-15103 WordPress WPFunnels 权限许可和访问控制问题漏洞 — WPFunnels – Funnel Builder for WooCommerce with Checkout & One Click Upsell 8.8 High2026-07-16
CVE-2026-13741 unitedover Digits: WordPress Mobile Number Signup and Login 权限许可和访问控制问题漏洞 — Digits: WordPress Mobile Number Signup and Login 8.8 High2026-07-16

CWE-269（特权管理不恰当） 是常见的弱点类别，本平台收录该类弱点关联的 1129 条 CVE 漏洞。