The product or the administrator places a user into an incorrect group.
View on MITREIf the incorrect group has more access or privileges than the intended group, the user might be able to bypass intended security policy to access unexpected resources or perform unexpected actions. The access-control system might not be able to detect malicious usage of this group membership.
No mitigation information available for this CWE.
No detection method information available for this CWE.
Operating system assigns user to privileged wheel group, allowing the user to gain root privileges.
View DetailsChain: drafted web request allows the creation of users with arbitrary group membership.
View DetailsChain: improper processing of configuration options causes users to contain unintended group memberships.
View DetailsCMS does not prevent remote administrators from promoting other users to the administrator group, in violation of the intended security model.
View DetailsProduct assigns members to the root group, allowing escalation of privileges.
View DetailsCWE-842: Placement of User into Incorrect Group is a Common Weakness Enumeration (CWE) entry maintained by MITRE. The product or the administrator places a user into an incorrect group. If the incorrect group has more access or privileges than the intended group, the user might be able to bypass intended security policy to access unexpected resources or perform unexpected actions. The access-control system might not be able to detect malicious usage of this group membership.
If exploited, CWE-842 (Placement of User into Incorrect Group) it can compromise Access Control, leading to outcomes such as Gain Privileges or Assume Identity.
CWE-842 commonly affects Not Language-Specific. Note that weaknesses are often language-agnostic patterns, so secure coding practices apply broadly.
MITRE documents real CVEs mapped to CWE-842, including CVE-1999-1193, CVE-2010-3716, CVE-2008-5397, CVE-2007-6644 and CVE-2007-3260. You can look up the full details of each CVE, including CVSS scores and remediation guidance, on our CVE Lookup tool.
A CWE (Common Weakness Enumeration) like CWE-842 describes a category of software weakness — the underlying flaw type. A CVE (Common Vulnerabilities and Exposures) identifies a specific, real-world vulnerability in a particular product. In short, a CWE is the kind of mistake, and a CVE is an instance of that mistake being found in software.