CWEweakness

CWE-286 Incorrect User Management

Official page ↗
Abstraction
Class
Structure
Simple
Status
Incomplete
Languages
Not Language-Specific
CWE version
5.0

Description

The product does not properly manage a user within its environment.

Extended description

Users can be assigned to the wrong group (class) of permissions.

Common consequences

• Access Control: Varies by Context, Gain Privileges or Assume Identity — Users may be given unintended access rights to sensitive objects, or assigned to the wrong group (class) of permissions.

Observed examples

• CVE-2022-36109: Containerization product does not record a user's supplementary group ID, allowing bypass of group restrictions. • CVE-1999-1193: Operating system assigns user to privileged wheel group, allowing the user to gain root privileges.

Related

Observed example · CVE (2)

  • CVE-2022-36109 Moby is an open-source project created by Docker to enable software containerization. vulnerability
  • CVE-1999-1193 The "me" user in NeXT NeXTstep 2.1 and earlier has wheel group privileges, which could allow the me user to use the su command to become… vulnerability

Child of · CWE (1)

  • CWE-284 Improper Access Control weakness

Referenced by CVE · weakness (32)

  • CVE-2026-56428 The SSH service on BSH ELP (Electronic Platform) modules contains a platform-specific vulnerability due to an improperly secured default… vulnerability
  • CVE-2026-60135 An attacker can modify data that should be restricted to read‑only access. vulnerability
  • CVE-2026-35638 OpenClaw before 2026.3.22 contains a privilege escalation vulnerability in the Control UI that allows unauthenticated sessions to retain… vulnerability
  • CVE-2025-64725 Weblate is a web based localization tool. vulnerability
  • CVE-2025-63563 Summer Pearl Group Vacation Rental Management Platform prior to v1.0.2 does not properly invalidate active user sessions after a password… vulnerability
  • CVE-2025-59943 phpMyFAQ is an open source FAQ web application. vulnerability
  • CVE-2025-7972 A security issue exists within the FactoryTalk Linx Network Browser. vulnerability
  • CVE-2024-48853 An escalation of privilege vulnerability in ASPECT could provide an attacker root access to a server when logged in as a "non" root ASPECT… vulnerability
  • CVE-2024-46671 An Incorrect User Management vulnerability [CWE-286] in FortiWeb version 7.6.2 and below, version 7.4.6 and below, version 7.2.10 and… vulnerability
  • CVE-2024-58105 A vulnerability in the Trend Micro Apex One Security Agent Plug-in User Interface Manager could allow a local attacker to bypass existing… vulnerability
  • CVE-2024-45425 Incorrect user management in some Zoom Workplace Apps may allow a privileged user to conduct an information disclosure via network access. vulnerability
  • CVE-2024-6356 An issue was discovered in GitLab EE affecting all versions starting from 16.0 prior to 17.0.6, starting from 17.1 prior to 17.1.4, and… vulnerability
  • CVE-2024-13041 An issue was discovered in GitLab CE/EE affecting all versions starting from 16.4 prior to 17.5.5, starting from 17.6 prior to 17.6.3, and… vulnerability
  • CVE-2024-52359 IBM Concert Software 1.0.0, 1.0.1, 1.0.2, and 1.0.2.1 could allow an authenticated user to perform unauthorized actions that should be… vulnerability
  • CVE-2024-9312 Authd, through version 0.3.6, did not sufficiently randomize user IDs to prevent collisions. vulnerability
  • CVE-2023-26689 An issue discovered in CS-Cart MultiVendor 4.16.1 allows attackers to alter arbitrary user account profiles via crafted post request. vulnerability
  • CVE-2024-28020 A user/password reuse vulnerability exists in the FOXMAN-UN/UNEM application and server management. vulnerability
  • CVE-2024-27269 IBM QRadar SIEM 7.5 could allow a privileged user to configure user management that would disclose unintended sensitive information across… vulnerability
  • CVE-2022-35503 Improper verification of a user input in Open Source MANO v7-v12 allows an authenticated attacker to execute arbitrary code within the LCM… vulnerability
  • CVE-2024-29296 A user enumeration vulnerability was found in Portainer CE 2.19.4. vulnerability
  • CVE-2023-51750 ScaleFusion 10.5.2 does not properly limit users to the Edge application because file downloads can occur. vulnerability
  • CVE-2023-3907 A privilege escalation vulnerability in GitLab EE affecting all versions from 16.0 prior to 16.4.4, 16.5 prior to 16.5.4, and 16.6 prior to… vulnerability
  • CVE-2023-3115 An issue has been discovered in GitLab EE affecting all versions affecting all versions from 11.11 prior to 16.2.8, 16.3 prior to 16.3.5,… vulnerability
  • CVE-2023-3914 A business logic error in GitLab EE affecting all versions prior to 16.2.8, 16.3 prior to 16.3.5, and 16.4 prior to 16.4.1 allows access to… vulnerability
  • CVE-2023-20253 A vulnerability in the command line interface (cli) management interface of Cisco SD-WAN vManage could allow an authenticated, local… vulnerability
  • CVE-2023-25519 NVIDIA ConnectX Host Firmware for the BlueField Data Processing Unit contains a vulnerability where a restricted host may cause an… vulnerability
  • CVE-2023-3932 An issue has been discovered in GitLab EE affecting all versions starting from 13.12 before 16.0.8, all versions starting from 16.1 before… vulnerability
  • CVE-2023-0857 Unintentional change of settings during initial registration of system administrators which uses control protocols. vulnerability
  • CVE-2022-45857 An incorrect user management vulnerability [CWE-286] in the FortiManager version 6.4.6 and below VDOM creation component may allow an… vulnerability
  • CVE-2022-32260 A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.2 SP1). vulnerability
Show all 32 ›

Referenced by CWE · can also be (1)

  • CWE-266 Incorrect Privilege Assignment weakness

Referenced by CWE · child of (1)

  • CWE-842 Placement of User into Incorrect Group weakness

Referenced by OWASP · mapped cwe (1)