Skip to content
OpenAdvisories

Weakness (CWE)

CWE-286: Incorrect User Management

Class Incomplete

The product does not properly manage a user within its environment.

More detail

Users can be assigned to the wrong group (class) of permissions.

Source: MITRE CWE-286

All Critical High Medium Low Exploited only Public exploit

12 results · Clear filters · Feed

  • High 8.1
    CVE-2026-56428

    The SSH service on BSH ELP (Electronic Platform) modules contains a platform-specific vulnerability due to an improperl…

    Bosch BSH ELP (Electronic Platform) Modules
  • High 8.8
    CVE-2026-35638

    OpenClaw < 2026.3.22 - Privilege Escalation via Self-Declared Scopes in Trusted-Proxy Control UI

    OpenClaw before 2026.3.22 contains a privilege escalation vulnerability in the Control UI that allows unauthenticated sessions to retain self-declared privileged scopes without device identity verification. Attackers can exploit the device-less allow path in …

    OpenClaw OpenClaw openclaw npm
  • High 8.1
    CVE-2025-59943

    phpMyFAQ duplicate email registration allows multiple accounts with the same email

    phpMyFAQ is an open source FAQ web application. Versions 4.0-nightly-2025-10-03 and below do not enforce uniqueness of email addresses during user registration. This allows multiple distinct accounts to be created with the same email. Because email is often u…

    thorsten phpMyFAQ thorsten/phpmyfaq Packagist
  • High 8.4
    CVE-2025-7972

    Rockwell Automation FactoryTalk® Linx Network Browser Security Bypass Vulnerability

    A security issue exists within the FactoryTalk Linx Network Browser. By modifying the process.env.NODE_ENV to ‘development’, the attacker can disable FTSP token validation. This bypass allows access to create, update, and delete FTLinx drivers.

    Rockwell Automation FactoryTalk Linx ICS / OT
  • High 7.3
    CVE-2024-58105

    A vulnerability in the Trend Micro Apex One Security Agent Plug-in User Interface Manager could allow a local attacker …

    Trend Micro Trend Micro Apex One Trend Micro Apex One as a Service
  • High 7.5
    CVE-2024-9312

    Authd allows attacker-controlled usernames to yield controllable UIDs

    Authd, through version 0.3.6, did not sufficiently randomize user IDs to prevent collisions. A local attacker who can register user names could spoof another user's ID and gain their privileges.

    Canonical authd github.com/ubuntu/authd Go
  • High 8.0
    CVE-2024-28020

    A user/password reuse vulnerability exists in the FOXMAN-UN/UNEM application and server management. If exploited a mali…

    Hitachi Energy UNEM FOXMAN-UN ICS / OT
  • High 7.5
    CVE-2022-35503

    Improper verification of a user input in Open Source MANO v7-v12 allows an authenticated attacker to execute arbitrary …

  • High 7.1
    CVE-2023-20253

    A vulnerability in the command line interface (cli) management interface of Cisco SD-WAN vManage could allow an authent…

    Cisco Cisco SD-WAN vManage Network devices
  • High 7.8
    CVE-2023-25519

    NVIDIA ConnectX Host Firmware for the BlueField Data Processing Unit contains a vulnerability where a restricted host m…

    NVIDIA BlueField 1 BlueField 2 GA BlueField 2 LTS
  • High 8.2
    CVE-2023-3932

    Incorrect User Management in GitLab

    An issue has been discovered in GitLab EE affecting all versions starting from 13.12 before 16.0.8, all versions starting from 16.1 before 16.1.3, all versions starting from 16.2 before 16.2.2. It was possible for an attacker to run pipeline jobs as an arbitr…

    GitLab GitLab Web / CMS
  • High 7.3
    CVE-2021-21553

    Dell PowerScale OneFS versions 8.1.0-9.1.0 contain an Incorrect User Management vulnerability.under some specific condi…

    Dell PowerScale OneFS