CWE-862 授权机制缺失 类弱点 7194 条 CVE 漏洞汇总，含 AI 中文分析。
CWE-862 属于缺失授权漏洞，指产品在用户访问资源或执行操作时未进行权限校验。攻击者通常通过直接修改请求参数或构造恶意 URL，绕过前端限制以访问未授权数据或执行敏感操作。开发者应避免仅依赖前端验证，需在服务端对每个请求实施严格的身份认证与权限检查，确保用户仅能访问其被授权的资源，从而从根本上消除越权风险。
function runEmployeeQuery($dbName, $name){ mysql_select_db($dbName,$globalDbHandle) or die("Could not open Database".$dbName); //Use a prepared statement to avoid CWE-89 $preparedStatement = $globalDbHandle->prepare('SELECT * FROM employees WHERE name = :name'); $preparedStatement->execute(array(':name' => $name)); return $preparedStatement->fetchAll(); } /.../ $employeeRecord = runEmployeeQuery('EmployeeDB',$_GET['EmployeeName']);sub DisplayPrivateMessage { my($id) = @_; my $Message = LookupMessageObject($id); print "From: " . encodeHTML($Message->{from}) . "<br>\n"; print "Subject: " . encodeHTML($Message->{subject}) . "\n"; print "<hr>\n"; print "Body: " . encodeHTML($Message->{body}) . "\n"; } my $q = new CGI; # For purposes of this example, assume that CWE-309 and # CWE-523 do not apply. if (! AuthenticateUser($q->param('username'), $q->param('password'))) { ExitError("invalid username or password"); } my $id = $q->param('id'); DisplayPrivateMessage($id);| CVE ID | 标题 | CVSS | 风险等级 | Published |
|---|---|---|---|---|
| CVE-2026-90595 | wxiaoqi Spring-Cloud-Platform 未授权访问漏洞 — Spring-Cloud-Platform | 6.3 | Medium | 2026-09-13 |
| CVE-2026-90594 | Spring-Cloud-Platform 权限服务权限检查漏洞 — Spring-Cloud-Platform | 6.3 | Medium | 2026-09-13 |
| CVE-2026-90768 | CAPEv2 API 任务端点缺失所有权检查漏洞 — CAPEv2 | 8.1 | High | 2026-09-13 |
| CVE-2026-90508 | Qilu Technology 驱动授权漏洞 — Ludashi | 3.4 | Low | 2026-09-13 |
| CVE-2026-90551 | WVideo 2.0.1.0 未授权访问漏洞 — AVideo | 5.3 | Medium | 2026-09-12 |
| CVE-2026-90547 | WWBN AVideo 缺失授权漏洞 — AVideo | 5.3 | Medium | 2026-09-12 |
| CVE-2026-90546 | Alike 视频 点赞接口 授权缺失 — AVideo | 4.3 | Medium | 2026-09-12 |
| CVE-2026-90545 | AVideo 评论添加接口认证缺失漏洞 — AVideo | 4.3 | Medium | 2026-09-12 |
| CVE-2026-90544 | AVideo 视频计数功能缺失授权漏洞 — AVideo | 4.3 | Medium | 2026-09-12 |
| CVE-2026-90540 | AVideo 播放列表添加视频接口缺失授权漏洞 — AVideo | 4.3 | Medium | 2026-09-12 |
| CVE-2026-90537 | WWBN AVideo Scheduler 发送邮件缺少Token授权 — AVideo | 8.2 | High | 2026-09-12 |
| CVE-2026-90535 | Flowise 3.1.4 前服务拒绝漏洞 — Flowise | 6.3 | Medium | 2026-09-12 |
| CVE-2026-90533 | Flowise 3.1.4之前 访问控制缺陷 — Flowise | 6.0 | Medium | 2026-09-12 |
| CVE-2026-11355 | DT LMS 1.1 未授权插件设置篡改漏洞 — DT LMS – elearning, WordPress LMS Plugin | 5.3 | Medium | 2026-09-12 |
| CVE-2026-90454 | Zeroc-ice读模式漏配允许修改会话标签 — Malcolm | 5.3 | Medium | 2026-09-11 |
| CVE-2026-90448 | 只读模式未限制写操作，致记录可被覆盖 — Malcolm | 7.1 | High | 2026-09-11 |
| CVE-2026-49439 | Open 只读用户可写预测数据点漏洞 — openremote | 4.3 | Medium | 2026-09-11 |
| CVE-2026-68535 | Concrete CMS 9.5.2 远程代码执行漏洞 — Concrete CMS | 5.1 | Medium | 2026-09-11 |
| CVE-2026-81916 | Concrete CMS 9.5.3 以下版本越权创建条目漏洞 — Concrete CMS | 5.1 | Medium | 2026-09-11 |
| CVE-2026-81915 | Concrete CMS 9.5.3 权限验证漏洞 — Concrete CMS | 5.1 | Medium | 2026-09-11 |
| CVE-2026-62089 | WordPress插件Master Addons 访问控制缺陷 — Master Addons for Elementor | 7.1 | High | 2026-09-11 |
| CVE-2026-62137 | bbPress插件2.6.14敏感数据暴露漏洞 — bbPress | 5.3 | Medium | 2026-09-11 |
| CVE-2026-62136 | WordPress插件Flexible Quantity <=2.3.21 访问控制失效漏洞 — Flexible Quantity – Measurement Price Calculator for WooCommerce | 5.3 | Medium | 2026-09-11 |
| CVE-2026-62135 | WordPress Booktics插件1.0.24访问控制失效漏洞 — Booktics | 5.3 | Medium | 2026-09-11 |
| CVE-2026-62132 | WordPress Masteriyo LMS插件3.4.0访问控制漏洞 — Masteriyo - LMS | 5.3 | Medium | 2026-09-11 |
| CVE-2026-62114 | WordPress Passster 4.3.13 访问控制失效漏洞 — Passster | 5.3 | Medium | 2026-09-11 |
| CVE-2026-27378 | WordPress插件Deposits 3.1.0 访问控制缺陷漏洞 — Deposits and Partial Payments for WooCommerce | 5.3 | Medium | 2026-09-11 |
| CVE-2026-81909 | Concrete CMS 9.5.2 缺失授权致数据泄露 — Concrete CMS | 5.9 | Medium | 2026-09-11 |
| CVE-2026-18122 | Concrete CMS 9.2.0-9.5.2 未授权访问漏洞 — Concrete CMS | 6.0 | Medium | 2026-09-11 |
| CVE-2026-81908 | Concrete CMS 9.2.0 至 9.5.2 组枚举漏洞 — Concrete CMS | 6.0 | Medium | 2026-09-11 |
CWE-862（授权机制缺失） 是常见的弱点类别，本平台收录该类弱点关联的 7194 条 CVE 漏洞。