CWE-269 特权管理不恰当 类弱点 1470 条 CVE 漏洞汇总，含 AI 中文分析。
CWE-269 属于权限管理不当漏洞，指产品未能正确分配、修改、跟踪或检查用户权限，导致攻击者获得非预期的控制范围。攻击者常利用此缺陷提升权限或越权访问敏感资源。开发者应实施最小权限原则，严格验证每次操作的身份与权限，确保权限分配、变更及撤销过程的安全性与完整性，从而防止未授权访问。
def makeNewUserDir(username): if invalidUsername(username): #avoid CWE-22 and CWE-78 print('Usernames cannot contain invalid characters') return False try: raisePrivileges() os.mkdir('/home/' + username) lowerPrivileges() except OSError: print('Unable to create new user directory for user:' + username) return False return Trueseteuid(0); /* do some stuff */ seteuid(getuid());| CVE ID | 标题 | CVSS | 风险等级 | Published |
|---|---|---|---|---|
| CVE-2026-115231 | 用户态模块伪造回调请求导致权限提升漏洞 — Eclipse ThreadX | 8.5 | High | 2026-11-03 |
| CVE-2026-91893 | Dell AWCC 6.14.54.0 前版本权限提升漏洞 — Alienware Command Center (AWCC) | 7.8 | High | 2026-11-02 |
| CVE-2026-110535 | Apache Syncope AuthProfile 权限提升漏洞 — Apache Syncope | - | - | 2026-11-02 |
| CVE-2026-120185 | YznCMS Auth Group.php 后台权限管理越权漏洞 — YznCMS | 4.7 | Medium | 2026-10-31 |
| CVE-2026-120070 | User Frontend 4.3.13 权限提升漏洞 — User Frontend – Membership, User Registration, User Profile, User Directory & Content Restriction with Frontend Post Submission | 8.8 | High | 2026-10-31 |
| CVE-2026-104012 | Rox预约1.3.1未认证权限提升漏洞 — Rox Appointment Booking – Event, Calendar & Appointment Scheduling | 8.8 | High | 2026-10-31 |
| CVE-2026-120040 | Mail logging & Catcher 2.2.0 敏感信息泄露及提权漏洞 — Mail logging & Catcher | 7.5 | High | 2026-10-31 |
| CVE-2026-61850 | Kargo API 项目 RBAC 管理权限提升漏洞 — kargo | 9.3 | Critical | 2026-10-30 |
| CVE-2026-105894 | Ak Framework 2.9.8 认证用户任意选项更新漏洞 — Ak Framework | 8.8 | High | 2026-10-30 |
| CVE-2026-118205 | Elementor Essential Addons 6.8.7 未授权权限提升漏洞 — Essential Addons for Elementor – Popular Elementor Templates & Widgets | 7.4 | High | 2026-10-30 |
| CVE-2026-101213 | Dell OpenManage Enterprise 4.8.0 前版本权限提升漏洞 — OpenManage Enterprise | 7.8 | High | 2026-10-30 |
| CVE-2026-86393 | Dell PowerProtect Data Domain 多版本权限提升漏洞 — PowerProtect Data Domain | 7.2 | High | 2026-10-28 |
| CVE-2026-76780 | BeyondSEO 1.3.6 权限提升漏洞 — BeyondSEO – AI SEO to Improve Rankings, Listings & Online Visibility | 6.3 | Medium | 2026-10-28 |
| CVE-2026-109381 | WooCommerce 插件 5.7.8 管理员提权漏洞 — Event Booking Manager for WooCommerce – Sell Tickets, Event Registration, RSVP & Event Calendar | 7.2 | High | 2026-10-28 |
| CVE-2026-58255 | Cronicle 事件创建与更新非管理员用户注入漏洞 — Cronicle | 8.8 | High | 2026-10-27 |
| CVE-2026-77172 | 应用密码绕过敏感端点密码确认漏洞 — Server | - | - | 2026-10-27 |
| CVE-2026-111584 | TeamViewer 补丁管理 Windows 本地提权漏洞 — TeamViewer Remote - Patch Management | 7.3 | High | 2026-10-27 |
| CVE-2026-111583 | TeamViewer Windows 客户端安装时本地提权漏洞 — Full Client | 7.3 | High | 2026-10-27 |
| CVE-2026-111582 | TeamViewer Monitoring Windows 本地提权漏洞 — Remote Management - Monitoring | 7.3 | High | 2026-10-27 |
| CVE-2026-90728 | Dell PowerProtect Data Domain 多版本权限提升漏洞 — PowerProtect Data Domain | 6.3 | Medium | 2026-10-27 |
| CVE-2026-90729 | Dell PowerProtect 多版本存在权限管理漏洞 — PowerProtect Data Domain | 6.7 | Medium | 2026-10-27 |
| CVE-2026-117466 | Octopus Server 任意版本存在权限提升漏洞 — Octopus Server | 8.6 | High | 2026-10-27 |
| CVE-2026-65220 | Supermicro BMC IPMI 权限提升漏洞 — MBD-X12SPI | 8.8 | High | 2026-10-27 |
| CVE-2026-117468 | Psono Server device-code 令牌提升漏洞 — Psono | 6.5 | Medium | 2026-10-27 |
| CVE-2026-116806 | OpenPanel 3.0.0 前版本 tRPC 权限提升漏洞 — openpanel | 5.4 | Medium | 2026-10-26 |
| CVE-2026-116471 | BKWLD Decoy Policy.php 权限管理漏洞 — Decoy | 4.3 | Medium | 2026-10-26 |
| CVE-2026-116223 | icret EasyImage del.php 权限管理漏洞 — EasyImage | 6.5 | Medium | 2026-10-26 |
| CVE-2026-116162 | Parse Server 9.0.0 短信 MFA 提权漏洞 — parse-server | 2.1 | Low | 2026-10-25 |
| CVE-2026-110018 | aBlocks 2.17.0 认证权限提升至 roleSlug 属性漏洞 — aBlocks – Gutenberg Blocks, User Dashboard Builder, Popup Builder, Form Builder & Animation Builder | 8.8 | High | 2026-10-24 |
| CVE-2026-115807 | User Profile Builder 4.0.3 权限提升漏洞 — User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor | 7.1 | High | 2026-10-24 |
CWE-269（特权管理不恰当） 是常见的弱点类别，本平台收录该类弱点关联的 1470 条 CVE 漏洞。