Cyber Resilience

CWE · MITRE source

CWE-282Improper Ownership Management

Abstraction: Class · CVEs in our corpus: 29

The product assigns the wrong ownership, or does not properly verify the ownership, of an object or resource.

Last updated: 20 August 2026 13:14 UTC

Cumulative inbound coverage

How completely the frameworks we cross-walk collectively cover this — the verdict is the strongest single mapping (overlapping partials are not summed); breadth shows the corroboration behind it.

Collective: partial · 3 mapping(s) from 3 framework(s): CAPEC 1 (partial) · STIG windows server 2016 1 (partial) · ATT&CK 1 (partial)

See the full cumulative-coverage rollup →

OWASP Top 10 for Web (2025)

This weakness contributes to A01:2025 Broken Access Control.

Control responseHuman-reviewed

Answering this weakness across the control lifecycle, from our framework cross-walks.

Prevent
Stop it (NIST 800-53 / CSF Protect)
  • PR.AA-05
  • AC-3 Access Enforcement
  • AC-16 Security and Privacy Attributes
  • AC-24 Access Control Decisions
Detect
Catch it (CSF Detect / Respond)

—

Harden
Shrink the surface (DISA STIG)
  • 1 hardening rule · 1 OS baseline
Validate
Prove the fix (OWASP ASVS)

—

NIST 800-53 r5 controls that address this weakness (0)AI-assisted

Control Title Family Why it addresses this CWE
No NIST controls proposed yet.

MITRE ATT&CK techniques this weakness enables

Our own two-way CWE↔ATT&CK cross-walk — a direct mapping with no public source (the CWE→CAPEC→ATT&CK chain leaves most top weaknesses, incl. XSS and SQLi, mapped to nothing).

Direction: ← other covers this; → this covers other (F/M/P = full / mostly / partial). gov = governs / implements (a mandate, not coverage).

T1574.005 Executable Installer File Permissions Weakness→PT1574.010 Services File Permissions Weakness←P →P

Top CVEs of this weakness type, ranked by Risk Priority

CVE Risk CVSS EPSS Published
CVE-2023-0386 KEV 8.57.80.07882023-03-22
CVE-2026-235146.88.80.01042026-03-25
CVE-2020-10632 6.28.80.00472022-02-24
CVE-2026-50130 6.18.80.00252026-07-14
CVE-2022-29187 5.97.80.00442022-07-12
CVE-2025-27254 5.98.00.00182025-03-10
CVE-2017-12189 5.87.80.00342018-01-10
CVE-2024-39755 5.87.80.00362024-10-03
CVE-2024-3383 5.77.40.00582024-04-10
CVE-2024-37999 5.67.80.00142024-07-08
CVE-2024-89495.16.30.00722024-09-17
CVE-2025-57732 5.17.50.00122025-08-20
CVE-2022-0026 5.06.70.00222022-05-11
CVE-2023-7226 5.06.30.00432024-01-11
CVE-2024-47816 4.96.40.00332024-10-09
CVE-2024-45104 4.86.30.00202024-09-13
CVE-2026-40214 4.86.30.00212026-05-07
CVE-2025-32946 4.45.30.00362025-04-15
CVE-2024-43176 4.35.40.00282025-01-09
CVE-2024-13246 4.35.30.00272025-01-09
CVE-2024-13249 4.25.40.00222025-01-09
CVE-2023-0989 3.74.30.00432023-09-29
CVE-2024-45103 3.74.30.00342024-09-13
CVE-2025-32945 3.64.30.00312025-04-15
CVE-2025-67642 3.64.30.00232025-12-10