CWE-269 特权管理不恰当 类弱点 1470 条 CVE 漏洞汇总，含 AI 中文分析。
CWE-269 属于权限管理不当漏洞，指产品未能正确分配、修改、跟踪或检查用户权限，导致攻击者获得非预期的控制范围。攻击者常利用此缺陷提升权限或越权访问敏感资源。开发者应实施最小权限原则，严格验证每次操作的身份与权限，确保权限分配、变更及撤销过程的安全性与完整性，从而防止未授权访问。
def makeNewUserDir(username): if invalidUsername(username): #avoid CWE-22 and CWE-78 print('Usernames cannot contain invalid characters') return False try: raisePrivileges() os.mkdir('/home/' + username) lowerPrivileges() except OSError: print('Unable to create new user directory for user:' + username) return False return Trueseteuid(0); /* do some stuff */ seteuid(getuid());| CVE ID | 标题 | CVSS | 风险等级 | Published |
|---|---|---|---|---|
| CVE-2026-15989 | Super Forms 6.3.316 未认证权限提升漏洞 — Super Forms – Drag & Drop Form Builder | 9.8 | Critical | 2026-10-01 |
| CVE-2026-19807 | ByteCoreStack 1.2.3 权限提升漏洞 — ByteCoreStack – MCP Connector for AI Tools | 8.8 | High | 2026-10-01 |
| CVE-2026-76145 | Genian SSL PNS 权限管理不当漏洞 — Genian SSL PNS (frodo-core) | 7.5 | High | 2026-10-01 |
| CVE-2026-102093 | Kiteworks Core 权限管理不当漏洞 — Core | 7.2 | High | 2026-09-30 |
| CVE-2026-86556 | 中兴U30 Air信息泄露漏洞 — U30 Air | 5.3 | Medium | 2026-09-30 |
| CVE-2026-102317 | Chrome 154.0.8037.92 Mojo权限管理漏洞 — Chrome | - | - | 2026-09-29 |
| CVE-2026-102710 | TXM任意内核回调导致特权提升 — eclipse-threadx/threadx | 9.3 | Critical | 2026-09-29 |
| CVE-2026-102676 | Electron webview绕过限制启用Web Worker Node集成漏洞 — electron | 8.3 | High | 2026-09-29 |
| CVE-2026-101860 | RaspAP raspap-webgui 提权漏洞 — raspap-webgui | 8.8 | High | 2026-09-29 |
| CVE-2026-101086 | 哪吒面板 2.3.5 前任务类型验证绕过漏洞 — nezha | 6.5 | Medium | 2026-09-27 |
| CVE-2026-77203 | Groups <= 4.6.0 已认证用户权限提升漏洞 — Groups – Memberships and Access Control | 8.8 | High | 2026-09-26 |
| CVE-2026-100686 | Budibase 3.45.0 前跨工作区权限提升漏洞 — server | 8.1 | High | 2026-09-26 |
| CVE-2026-100620 | Capgo CLI 7.98.2 过度权限漏洞 — @capgo/cli | 3.8 | Low | 2026-09-26 |
| CVE-2026-100615 | Capgo 12.267.1 前 API 密钥轮换提权漏洞 — capgo.app | 8.8 | High | 2026-09-26 |
| CVE-2026-100611 | Capgo apikey_manager 角色权限提升漏洞 — capgo.app | 6.5 | Medium | 2026-09-26 |
| CVE-2026-100586 | OpenClaw Codex 2026.7.1 前绑定授权绕过漏洞 — OpenClaw | 8.8 | High | 2026-09-26 |
| CVE-2026-100578 | OpenClaw 2026.7.1前聊天发送授权绕过漏洞 — OpenClaw | 7.6 | High | 2026-09-26 |
| CVE-2026-45801 | GLPI 通过配置文件更新未授权激活调试模式（权限提升）漏洞 — glpi | 5.3 | Medium | 2026-09-25 |
| CVE-2026-97895 | Krayin Laravel CRM 权限管理漏洞 — laravel-crm | 6.3 | Medium | 2026-09-25 |
| CVE-2026-56733 | Zammad 错误授权与权限管理漏洞 — zammad | 8.7 | High | 2026-09-25 |
| CVE-2026-89426 | Knit Pay ≤ 9.6.1.0 权限提升漏洞 — Knit Pay – Cashfree, Instamojo, Razorpay, PayPal and more | 8.8 | High | 2026-09-25 |
| CVE-2026-93901 | Optima Express IDX <=8.7.5 未授权提权至作者角色漏洞 — Optima Express IDX | 7.3 | High | 2026-09-25 |
| CVE-2026-14281 | Automation Web Platform <= 4.8.6 未授权权限提升漏洞 — Automation Web Platform – Notifications and OTP for WooCommerce, Advanced Country Code | 9.8 | Critical | 2026-09-25 |
| CVE-2026-52853 | Docmost权限提升漏洞：管理员可邀请用户为所有者 — docmost | 5.2 | Medium | 2026-09-24 |
| CVE-2026-94609 | authentik 提权漏洞：通过组层次结构提升为超级用户 — authentik | 8.8 | High | 2026-09-24 |
| CVE-2026-18467 | Paytium ≤5.0.3 未授权权限提升漏洞 — Paytium: Mollie payment forms & donations | 9.8 | Critical | 2026-09-24 |
| CVE-2026-61413 | Dell SCG 5.34前版本权限管理漏洞 — Secure Connect Gateway (SCG) Policy Manager | 6.8 | Medium | 2026-09-23 |
| CVE-2026-17645 | IBM FTM 多个安全漏洞 — Financial Transaction Manager (FTM) for RedHat OpenShift | 9.1 | Critical | 2026-09-22 |
| CVE-2026-17472 | IBM Concert 软件多个漏洞 — Concert | 9.6 | Critical | 2026-09-22 |
| CVE-2026-83597 | Netdata Windows Agent 安装程序权限提升漏洞 — netdata | 7.0 | High | 2026-09-22 |
CWE-269（特权管理不恰当） 是常见的弱点类别，本平台收录该类弱点关联的 1470 条 CVE 漏洞。