CWE-286 · Access Control
Incorrect User Management
32CVEs
SortMost likely exploited
32 CVEs with CWE-286 as their weakness
| CVE · most likely exploited | CVSS | EPSS | Published |
|---|---|---|---|
| CVE-2024-29296A user enumeration vulnerability was found in Portainer CE 2.19.4. This issue occurs during user authentication process, where a difference in response time could allow a remote u…Portainer · Portainer · CVSS 5.3 · 2024-04-10 | 5.3 | 1.3% | 2024-04-10 |
| CVE-2023-3932Incorrect User Management in GitLabGitLab · GitLab · CVSS 8.2 · 2023-08-03 | 8.2 | 0.9% | 2023-08-03 |
| CVE-2022-32260A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.2 SP1). The affected application creates temporary user credentials for UMC (User Management…Siemens · SINEMA Remote Connect Server · CVSS 6.5 · 2022-06-14 | 6.5 | 0.8% | 2022-06-14 |
| CVE-2023-3907Improper User Management in GitLabGitLab · GitLab · CVSS 4.9 · 2023-12-17 | 4.9 | 0.7% | 2023-12-17 |
| CVE-2021-26262Philips MRI 1.5T and 3T Improper Access ControlPhilips · MRI 1.5T · CVSS 5.9 · 2021-11-19 | 5.9 | 0.7% | 2021-11-19 |
| CVE-2023-26689An issue discovered in CS-Cart MultiVendor 4.16.1 allows attackers to alter arbitrary user account profiles via crafted post request.Cs-Cart · Cs-Cart Multivendor · CVSS 9.8 · 2024-09-24 | 9.8 | 0.6% | 2024-09-24 |
| CVE-2023-0857Unintentional change of settings during initial registration of system administrators which uses control protocols. The affected Office / Small Office Multifunction Printers and L…Canon Inc. · Canon Office/Small Office Multifunction Printers and Laser Printers · CVSS 5.9 · 2023-05-11 | 5.9 | 0.6% | 2023-05-11 |
| CVE-2022-35503Improper verification of a user input in Open Source MANO v7-v12 allows an authenticated attacker to execute arbitrary code within the LCM module container via a Virtual Network F…No vendor recorded · CVSS 7.5 · 2024-04-22 | 7.5 | 0.5% | 2024-04-22 |
| CVE-2025-7972Rockwell Automation FactoryTalk® Linx Network Browser Security Bypass VulnerabilityRockwell Automation · FactoryTalk® Linx · CVSS 8.4 · 2025-08-14 | 8.4 | 0.5% | 2025-08-14 |
| CVE-2026-56428The SSH service on BSH ELP (Electronic Platform) modules contains a platform-specific vulnerability due to an improperly secured default configuration. An insecure, non-revocable…Bosch · BSH ELP (Electronic Platform) Modules · CVSS 8.1 · 2026-07-30 | 8.1 | 0.5% | 2026-07-30 |
| CVE-2024-46671An Incorrect User Management vulnerability [CWE-286] in FortiWeb version 7.6.2 and below, version 7.4.6 and below, version 7.2.10 and below, version 7.0.11 and below widgets dashb…Fortinet · FortiWeb · CVSS 5.6 · 2025-04-08 | 5.6 | 0.5% | 2025-04-08 |
| CVE-2024-27269IBM QRadar SIEM information disclosureIBM · QRadar SIEM · CVSS 6.8 · 2024-05-10 | 6.8 | 0.4% | 2024-05-10 |
| CVE-2023-3914Incorrect User Management in GitLabGitLab · GitLab · CVSS 5.4 · 2023-09-29 | 5.4 | 0.4% | 2023-09-29 |
| CVE-2025-59943phpMyFAQ duplicate email registration allows multiple accounts with the same emailthorsten · phpMyFAQ · CVSS 8.1 · 2025-10-03 | 8.1 | 0.4% | 2025-10-03 |
| CVE-2023-3115Incorrect User Management in GitLabGitLab · GitLab · CVSS 5.4 · 2023-09-29 | 5.4 | 0.4% | 2023-09-29 |
| CVE-2024-48853Authenticated Escalation to guest to rootABB · ASPECT-Enterprise · CVSS 9 · 2025-05-22 | 9.0 | 0.4% | 2025-05-22 |
| CVE-2026-60135Weintek cMT3092X Incorrect User ManagementWeintek · cMT3092X firmware · CVSS 6.5 · 2026-07-24 | 6.5 | 0.4% | 2026-07-24 |
| CVE-2024-28020A user/password reuse vulnerability exists in the FOXMAN-UN/UNEM application and server management. If exploited a malicious high-privileged user could use the passwords and login…Hitachi Energy · FOXMAN-UN · CVSS 8 · 2024-06-11 | 8.0 | 0.4% | 2024-06-11 |
| CVE-2025-64725Weblate has improper validation upon invitation acceptanceWeblateOrg · weblate · CVSS 1 · 2025-12-15 | 1.0 | 0.3% | 2025-12-15 |
| CVE-2022-45857An incorrect user management vulnerability [CWE-286] in the FortiManager version 6.4.6 and below VDOM creation component may allow an attacker to access a FortiGate without a pass…Fortinet · FortiManager · CVSS 6 · 2023-01-05 | 6.0 | 0.3% | 2023-01-05 |
| CVE-2024-45425Zoom Workplace Apps - Incorrect User ManagementZoom Communications, Inc · Zoom Workplace Apps · CVSS 4.9 · 2025-02-25 | 4.9 | 0.3% | 2025-02-25 |
| CVE-2024-52359IBM Concert Software improper access controlsIBM · Concert Software · CVSS 4.3 · 2024-11-19 | 4.3 | 0.3% | 2024-11-19 |
| CVE-2024-13041Incorrect User Management in GitLabGitLab · GitLab · CVSS 4.2 · 2025-01-09 | 4.2 | 0.3% | 2025-01-09 |
| CVE-2026-35638OpenClaw < 2026.3.22 - Privilege Escalation via Self-Declared Scopes in Trusted-Proxy Control UIOpenClaw · OpenClaw · CVSS 8.8 · 2026-04-09 | 8.8 | 0.3% | 2026-04-09 |
| CVE-2023-51750ScaleFusion 10.5.2 does not properly limit users to the Edge application because file downloads can occur. NOTE: the vendor's position is "Not vulnerable if the default Windows de…Scalefusion · Scalefusion · 2024-01-11 | – | 0.3% | 2024-01-11 |
| CVE-2024-9312Authd, through version 0.3.6, did not sufficiently randomize user IDs to prevent collisions. A local attacker who can register user names could spoof another user's ID and gain th…Canonical Ltd. · Authd · CVSS 7.5 · 2024-10-10 | 7.5 | 0.3% | 2024-10-10 |
| CVE-2025-63563Summer Pearl Group Vacation Rental Management Platform prior to v1.0.2 does not properly invalidate active user sessions after a password change. This allows an attacker with a va…Summerpearlgroup · Vacation Rental Management Platform · CVSS 6.5 · 2025-10-31 | 6.5 | 0.3% | 2025-10-31 |
| CVE-2021-21553Dell PowerScale OneFS versions 8.1.0-9.1.0 contain an Incorrect User Management vulnerability.under some specific conditions, this can allow the CompAdmin user to elevate privileg…Dell · PowerScale OneFS · CVSS 7.3 · 2021-08-02 | 7.3 | 0.2% | 2021-08-02 |
| CVE-2024-6356Incorrect User Management in GitLabGitLab · GitLab · CVSS 4.4 · 2025-02-05 | 4.4 | 0.2% | 2025-02-05 |
| CVE-2023-25519NVIDIA ConnectX Host Firmware for the BlueField Data Processing Unit contains a vulnerability where a restricted host may cause an incorrect user management error. A successful ex…NVIDIA · BlueField 1 · CVSS 7.8 · 2023-09-12 | 7.8 | 0.2% | 2023-09-12 |
| CVE-2023-20253A vulnerability in the command line interface (cli) management interface of Cisco SD-WAN vManage could allow an authenticated, local attacker to bypass authorization and allow the…Cisco · Cisco SD-WAN vManage · CVSS 7.1 · 2023-09-27 | 7.1 | 0.2% | 2023-09-27 |
| CVE-2024-58105A vulnerability in the Trend Micro Apex One Security Agent Plug-in User Interface Manager could allow a local attacker to bypass existing security and execute arbitrary code on af…Trend Micro, Inc. · Trend Micro Apex One · CVSS 7.3 · 2025-03-25 | 7.3 | 0.2% | 2025-03-25 |
EPSS is the probability of exploitation in the next 30 days (FIRST). Data as of 2026-11-14.