CWE-269 特权管理不恰当 类弱点 1470 条 CVE 漏洞汇总，含 AI 中文分析。
CWE-269 属于权限管理不当漏洞，指产品未能正确分配、修改、跟踪或检查用户权限，导致攻击者获得非预期的控制范围。攻击者常利用此缺陷提升权限或越权访问敏感资源。开发者应实施最小权限原则，严格验证每次操作的身份与权限，确保权限分配、变更及撤销过程的安全性与完整性，从而防止未授权访问。
def makeNewUserDir(username): if invalidUsername(username): #avoid CWE-22 and CWE-78 print('Usernames cannot contain invalid characters') return False try: raisePrivileges() os.mkdir('/home/' + username) lowerPrivileges() except OSError: print('Unable to create new user directory for user:' + username) return False return Trueseteuid(0); /* do some stuff */ seteuid(getuid());| CVE ID | 标题 | CVSS | 风险等级 | Published |
|---|---|---|---|---|
| CVE-2026-104748 | SimpleForm <= 3.10.0 未授权权限提升漏洞 — SimpleForm – Form Maker to Chat Apps with Quiz, Poll and Multi Lead Notifications | 9.8 | Critical | 2026-10-14 |
| CVE-2026-104767 | WooCommerce插件 20260828版 权限提升漏洞 — Membership & User Roles for WooCommerce (Automatic Role Changer) | 7.5 | High | 2026-10-14 |
| CVE-2026-104749 | Bit integrations <= 2.10.6 未授权权限提升漏洞 — Bit integrations – Form Integration, Webhook, Spreadsheets, CRM, LMS & Email Automation | 7.5 | High | 2026-10-14 |
| CVE-2026-85990 | Leantime 认证用户通过未授权 JSON-RPC 方法提权 — leantime | 8.8 | High | 2026-10-13 |
| CVE-2026-109143 | Cal.com 凭据删除漏洞 — cal.com | 5.4 | Medium | 2026-10-13 |
| CVE-2026-18343 | IBM i 权限管理不当漏洞 — i | 4.4 | Medium | 2026-10-12 |
| CVE-2026-109667 | Frappe ERPNext 15.111.0之前版本提权漏洞 — erpnext | 8.8 | High | 2026-10-12 |
| CVE-2024-58390 | Frappe <15.41.0 文档操作权限提升漏洞 — frappe | 8.8 | High | 2026-10-12 |
| CVE-2026-18513 | IBM Maximo Application Suite 位置服务权限管理漏洞 — Maximo Application Suite - Location Service for Esri Component | 7.2 | High | 2026-10-12 |
| CVE-2026-109567 | Rapyd Admin 9.0.0至9.20.0用户编辑组件权限提升漏洞 — rapyd-admin | 7.2 | High | 2026-10-12 |
| CVE-2026-95837 | containerd CRI插件：检查点恢复绕过目标安全上下文 — containerd | 7.8 | High | 2026-10-12 |
| CVE-2026-105464 | IBM Db2 本地提权漏洞 — Db2 | 8.8 | High | 2026-10-12 |
| CVE-2026-105465 | IBM Db2 启用db2ssh时的权限提升漏洞 — Db2 | 8.8 | High | 2026-10-12 |
| CVE-2026-78404 | IBM Db2 本地权限提升漏洞 — Db2 | 6.5 | Medium | 2026-10-12 |
| CVE-2026-109317 | Grav API插件1.0.36以下版本提权漏洞 — grav-plugin-api | 7.2 | High | 2026-10-12 |
| CVE-2026-85956 | Progress MarkLogic Server 备份恢复权限管理漏洞 — MarkLogic Server | 9.6 | Critical | 2026-10-12 |
| CVE-2026-85955 | Progress MarkLogic Server xdmp:eval-in 权限管理不当漏洞 — MarkLogic Server | 9.9 | Critical | 2026-10-12 |
| CVE-2026-85954 | Progress MarkLogic Server 高阶XQuery函数权限管理漏洞 — MarkLogic Server | 8.6 | High | 2026-10-12 |
| CVE-2026-85950 | Progress MarkLogic Server REST扩展权限管理不当漏洞 — MarkLogic Server | 8.4 | High | 2026-10-12 |
| CVE-2026-85948 | Progress MarkLogic Server Management API 权限管理不当漏洞 — MarkLogic Server | 9.9 | Critical | 2026-10-12 |
| CVE-2026-85947 | Progress MarkLogic Server 森林操作权限管理不当漏洞 — MarkLogic Server | 9.9 | Critical | 2026-10-12 |
| CVE-2026-108835 | 永恒信云佳卫士 kgameprotect.sys 权限管理漏洞 — Yun Jia Security Guard | 4.4 | Medium | 2026-10-12 |
| CVE-2026-108825 | 若依RuoYi 权限管理绕过漏洞 — RuoYi | 5.4 | Medium | 2026-10-12 |
| CVE-2026-108506 | 中兴Z80 Ultra 产品未授权访问漏洞 — Z80 Ultra | 5.5 | Medium | 2026-10-10 |
| CVE-2026-108505 | 中兴 Z80 Ultra 信息泄露漏洞 — Z80 Ultra | 3.3 | Low | 2026-10-10 |
| CVE-2026-108504 | ZTE Z80 Ultra 未授权信息检索漏洞 — Z80 Ultra | 5.5 | Medium | 2026-10-10 |
| CVE-2026-108502 | 中兴Z80 Ultra信息泄露漏洞 — Z80 Ultra | 3.3 | Low | 2026-10-10 |
| CVE-2026-92975 | Groundhogg <=4.8.3 未授权权限提升致身份混淆漏洞 — Groundhogg — CRM, Newsletters, and Marketing Automation | 8.1 | High | 2026-10-10 |
| CVE-2026-77183 | FooSales <=1.43.0 权限提升漏洞 — FooSales – Point of Sale (POS) for WooCommerce | 8.8 | High | 2026-10-10 |
| CVE-2026-104725 | Groundhogg <=4.9 认证用户权限提升漏洞 — Groundhogg — CRM, Newsletters, and Marketing Automation | 8.8 | High | 2026-10-10 |
CWE-269（特权管理不恰当） 是常见的弱点类别，本平台收录该类弱点关联的 1470 条 CVE 漏洞。