CWE-842: Placement of User into Incorrect Group

Base

The product or the administrator places a user into an incorrect group.

If the incorrect group has more access or privileges than the intended group, the user might be able to bypass intended security policy to access unexpected resources or perform unexpected actions. The access-control system might not be able to detect malicious usage of this group membership.

Consequences

Access Control: Gain Privileges or Assume Identity

Recent advisories

GHSA-fjm8-m7m6-2fjp — Buildah's incorrect handling of the supplementary groups may lead to data disclosure, modification
GHSA-4wjj-jwc9-2x96 — Podman's incorrect handling of the supplementary groups may lead to data disclosure, modification

All advisories for CWE-842

Is this in your code?

MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.

Check your repos with MergeHarbor