Skip to content
Log inStart free trial

CWE-286: Incorrect User Management

Class

The product does not properly manage a user within its environment.

Users can be assigned to the wrong group (class) of permissions resulting in unintended access rights to sensitive objects.

Consequences

  • Other: Varies by Context

Recent advisories

  • GHSA-48vw-m3qc-wr99 — OpenClaw's Trusted-proxy Control UI sessions retain privileged scopes without device identity on device-less allow paths
  • GHSA-m6hq-f4w9-qrjj — Weblate has improper validation upon invitation acceptance
  • GHSA-9wj2-4hcm-r74j — phpMyFAQ duplicate email registration allows multiple accounts with the same email

All advisories for CWE-286

Is this in your code?

MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.

Check your repos with MergeHarbor