CWE-286, Incorrect User Management, is a class weakness: the product does not properly manage a user within its environment. MITRE explains that users can be assigned to the wrong group of permissions, giving unintended access to sensitive objects.
It concerns anyone who builds account provisioning, role assignment, or container and OS user handling.
How it happens
Group membership is part of identity. If a system loses or mishandles it, a user's effective rights change without anyone deciding that.
MITRE's examples:
- CVE-2022-36109 (Gold): a containerization product does not record a user's supplementary group ID, allowing bypass of group restrictions.
- CVE-1999-1193 (Gold): an operating system assigns a user to the privileged wheel group, allowing them to gain root privileges.
What an attacker gains
The impact varies by context. Typically it is access to objects the user's real role should not reach.
How to find it
- Export group and role membership and compare it to what each person needs.
- Check that group membership survives process creation, container start, and session handoff.
- Look for default group assignments in installers and provisioning scripts.
How to fix it
Assign groups explicitly, review them on a schedule, and test that restrictions still hold after any context change. Default new users to the least privileged group and add rights deliberately.
Quick check
How can dropping a group cause a security problem?
If supplementary groups are not recorded, a restriction that relies on group membership may not be enforced, as in the container product example.
Sources
- MITRE CWE-286: https://cwe.mitre.org/data/definitions/286.html
- Safeguard Gold entry: https://gold.safeguard.sh/cwe/CWE-286
