# CWE-286.

Every Advisory and CVE whose sources give the weakness CWE-286, newest first.

## Records, newest first

- [Bosch BSH ELP (Electronic Platform) Modules: The SSH service on BSH ELP (Electronic Platform) modules contains a platform-specific…](https://agentprime.io/advisories/CVE-2026-56428.md)
  `CVE-2026-56428` · CVE record: Bosch BSH ELP (Electronic Platform) Modules · CVSS 8.1 High · Not analysed yet · Published 30 Jul 2026 · Tags: CWE-286
- [Weintek cMT3092X Incorrect User Management](https://agentprime.io/advisories/CVE-2026-60135.md)
  `CVE-2026-60135` · CVE record: Weintek cMT3092X firmware and 1 more · CVSS 7.1 High · Not analysed yet · Published 24 Jul 2026 · Tags: CWE-286
- [OpenClaw's Trusted-proxy Control UI sessions retain privileged scopes without device identity on device-less allow paths](https://agentprime.io/advisories/GHSA-48vw-m3qc-wr99.md)
  `GHSA-48vw-m3qc-wr99`, `CVE-2026-35638` · npm `openclaw`: affected `<2026.3.22`, fixed in `2026.3.22` · CVSS 8.7 High · Not analysed yet · Published 26 Mar 2026 · Tags: CWE-286
- [Weblate has improper validation upon invitation acceptance](https://agentprime.io/advisories/GHSA-m6hq-f4w9-qrjj.md)
  `GHSA-m6hq-f4w9-qrjj`, `CVE-2025-64725`, `PYSEC-2026-2042` · PyPI `weblate`: affected `<5.15`, fixed in `5.15` · CVSS 1.0 Low · Not analysed yet · Published 15 Dec 2025 · Tags: CWE-286
- [Summer Pearl Group Vacation Rental Management Platform prior to v1.0.2 does not properly invalidate active user sessions after a password change.](https://agentprime.io/advisories/CVE-2025-63563.md)
  `CVE-2025-63563` · CVE record · CVSS 6.5 Medium · Not analysed yet · Published 31 Oct 2025 · Tags: CWE-286
- [phpMyFAQ duplicate email registration allows multiple accounts with the same email](https://agentprime.io/advisories/GHSA-9wj2-4hcm-r74j.md)
  `GHSA-9wj2-4hcm-r74j`, `CVE-2025-59943`, `PKSA-pzch-4td8-nkvb` · Packagist `thorsten/phpmyfaq`: affected `>=4.0.7, <4.0.13`, fixed in `4.0.13` · CVSS 8.1 High · Not analysed yet · Published 3 Oct 2025 · Tags: Broken access control, CWE-286
- [Rockwell Automation FactoryTalk® Linx Network Browser Security Bypass Vulnerability](https://agentprime.io/advisories/CVE-2025-7972.md)
  `CVE-2025-7972` · CVE record: Rockwell Automation FactoryTalk® Linx · CVSS 8.4 High · Not analysed yet · Published 14 Aug 2025 · Tags: CWE-286
- [Authenticated Escalation to guest to root](https://agentprime.io/advisories/CVE-2024-48853.md)
  `CVE-2024-48853` · CVE record: ABB ASPECT-Enterprise and 2 more · CVSS 9.5 Critical · Critical (CVSS 9+) · Not analysed yet · Published 22 May 2025 · Tags: CWE-286
- [Fortinet FortiWeb: An Incorrect User Management vulnerability \[CWE-286\] in FortiWeb version 7.6.2 and below…](https://agentprime.io/advisories/CVE-2024-46671.md)
  `CVE-2024-46671` · CVE record: Fortinet FortiWeb · CVSS 5.6 Medium · Not analysed yet · Published 8 Apr 2025 · Tags: CWE-286
- [Trend Micro, Inc. Trend Micro Apex One: A vulnerability in the Trend Micro Apex One Security Agent Plug-in User Interface Manager…](https://agentprime.io/advisories/CVE-2024-58105.md)
  `CVE-2024-58105` · CVE record: Trend Micro, Inc. Trend Micro Apex One and 1 more · CVSS 7.3 High · Not analysed yet · Published 25 Mar 2025 · Tags: CWE-286
- [Zoom Workplace Apps - Incorrect User Management](https://agentprime.io/advisories/CVE-2024-45425.md)
  `CVE-2024-45425` · CVE record: Zoom Communications, Inc Zoom Workplace Apps · CVSS 4.9 Medium · Not analysed yet · Published 25 Feb 2025 · Tags: CWE-286
- [Incorrect User Management in GitLab](https://agentprime.io/advisories/CVE-2024-6356.md)
  `CVE-2024-6356` · CVE record: GitLab GitLab · CVSS 4.4 Medium · Not analysed yet · Published 5 Feb 2025 · Tags: CWE-286
- [Incorrect User Management in GitLab](https://agentprime.io/advisories/CVE-2024-13041.md)
  `CVE-2024-13041` · CVE record: GitLab GitLab · CVSS 4.2 Medium · Not analysed yet · Published 9 Jan 2025 · Tags: CWE-286
- [IBM Concert Software improper access controls](https://agentprime.io/advisories/CVE-2024-52359.md)
  `CVE-2024-52359` · CVE record: IBM Concert Software · CVSS 4.3 Medium · Not analysed yet · Published 19 Nov 2024 · Tags: CWE-286
- [Authd allows attacker-controlled usernames to yield controllable UIDs in github.com/ubuntu/authd](https://agentprime.io/advisories/GHSA-4gfw-wf7c-w6g2.md)
  `GHSA-4gfw-wf7c-w6g2`, `CVE-2024-9312`, `GO-2024-3188` · Go `github.com/ubuntu/authd`: affected `<0.3.6`, fixed in `0.3.6` · CVSS 7.5 High · Not analysed yet · Published 11 Oct 2024 · Tags: CWE-286
- [An issue discovered in CS-Cart MultiVendor 4.16.1 allows attackers to alter arbitrary user account profiles via crafted post request.](https://agentprime.io/advisories/CVE-2023-26689.md)
  `CVE-2023-26689` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 24 Sept 2024 · Tags: CWE-286
- [A user/password reuse vulnerability exists in the FOXMAN-UN/UNEM application and server management.](https://agentprime.io/advisories/CVE-2024-28020.md)
  `CVE-2024-28020` · CVE record: Hitachi Energy FOXMAN-UN and 1 more · CVSS 8.0 High · Not analysed yet · Published 11 Jun 2024 · Tags: CWE-286
- [IBM QRadar SIEM information disclosure](https://agentprime.io/advisories/CVE-2024-27269.md)
  `CVE-2024-27269` · CVE record: IBM QRadar SIEM · CVSS 6.8 Medium · Not analysed yet · Published 10 May 2024 · Tags: CWE-286
- [Improper verification of a user input in Open Source MANO v7-v12 allows an authenticated attacker to execute arbitrary code within the LCM module container via a Virtual Network Function (VNF) descri…](https://agentprime.io/advisories/CVE-2022-35503.md)
  `CVE-2022-35503` · CVE record · CVSS 7.5 High · Not analysed yet · Published 22 Apr 2024 · Tags: Command injection, CWE-286
- [Portainer CE allows username enumeration through authentication response timing](https://agentprime.io/advisories/GHSA-87x6-8m9v-g8c2.md)
  `GHSA-87x6-8m9v-g8c2`, `CVE-2024-29296`, `GO-2026-6619` · Go `github.com/portainer/portainer`: affected `<0.6.1-0.20240417040827-48bc7d0d92f0`, fixed in `0.6.1-0.20240417040827-48bc7d0d92f0` · CVSS 5.3 Medium · Not analysed yet · Published 10 Apr 2024 · Tags: CWE-286
- [ScaleFusion 10.5.2 does not properly limit users to the Edge application because file downloads can occur.](https://agentprime.io/advisories/CVE-2023-51750.md)
  `CVE-2023-51750` · CVE record · No CVSS score · Not analysed yet · Published 11 Jan 2024 · Tags: CWE-286
- [Improper User Management in GitLab](https://agentprime.io/advisories/CVE-2023-3907.md)
  `CVE-2023-3907` · CVE record: GitLab GitLab · CVSS 4.9 Medium · Not analysed yet · Published 17 Dec 2023 · Tags: CWE-286
- [Incorrect User Management in GitLab](https://agentprime.io/advisories/CVE-2023-3115.md)
  `CVE-2023-3115` · CVE record: GitLab GitLab · CVSS 5.4 Medium · Not analysed yet · Published 29 Sept 2023 · Tags: CWE-286
- [Incorrect User Management in GitLab](https://agentprime.io/advisories/CVE-2023-3914.md)
  `CVE-2023-3914` · CVE record: GitLab GitLab · CVSS 5.4 Medium · Not analysed yet · Published 29 Sept 2023 · Tags: CWE-286
- [Cisco SD-WAN vManage: A vulnerability in the command line interface (cli) management interface of Cisco SD-WAN…](https://agentprime.io/advisories/CVE-2023-20253.md)
  `CVE-2023-20253` · CVE record: Cisco Cisco SD-WAN vManage · CVSS 7.1 High · Not analysed yet · Published 27 Sept 2023 · Tags: CWE-286
- [NVIDIA ConnectX Host Firmware for the BlueField Data Processing Unit contains a vulnerability where a restricted host may cause an incorrect user management error.](https://agentprime.io/advisories/CVE-2023-25519.md)
  `CVE-2023-25519` · CVE record: NVIDIA BlueField 1 and 3 more · CVSS 7.8 High · Not analysed yet · Published 12 Sept 2023 · Tags: CWE-286
- [Incorrect User Management in GitLab](https://agentprime.io/advisories/CVE-2023-3932.md)
  `CVE-2023-3932` · CVE record: GitLab GitLab · CVSS 8.2 High · Not analysed yet · Published 3 Aug 2023 · Tags: CWE-286
- [Unintentional change of settings during initial registration of system administrators which uses control protocols.](https://agentprime.io/advisories/CVE-2023-0857.md)
  `CVE-2023-0857` · CVE record: Canon Inc. Canon Office/Small Office Multifunction Printers and Laser Printers · CVSS 5.9 Medium · Not analysed yet · Published 11 May 2023 · Tags: CWE-286
- [Fortinet FortiManager: An incorrect user management vulnerability \[CWE-286\] in the FortiManager version 6.4.6…](https://agentprime.io/advisories/CVE-2022-45857.md)
  `CVE-2022-45857` · CVE record: Fortinet FortiManager · CVSS 6.0 Medium · Not analysed yet · Published 5 Jan 2023 · Tags: CWE-286
- [A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.2 SP1).](https://agentprime.io/advisories/CVE-2022-32260.md)
  `CVE-2022-32260` · CVE record: Siemens SINEMA Remote Connect Server · CVSS 6.5 Medium · Not analysed yet · Published 14 Jun 2022 · Tags: CWE-286
- [Philips MRI 1.5T and 3T Improper Access Control](https://agentprime.io/advisories/CVE-2021-26262.md)
  `CVE-2021-26262` · CVE record: Philips MRI 1.5T and 1 more · CVSS 5.9 Medium · Not analysed yet · Published 19 Nov 2021 · Tags: CWE-286
- [Dell PowerScale OneFS: Dell PowerScale OneFS versions 8.1.0-9.1.0 contain an Incorrect User Management…](https://agentprime.io/advisories/CVE-2021-21553.md)
  `CVE-2021-21553` · CVE record: Dell PowerScale OneFS · CVSS 7.3 High · Not analysed yet · Published 2 Aug 2021 · Tags: CWE-286

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=cwe-286>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/cwe-286/>. Everything for agents: <https://agentprime.io/llms.txt>.