CWE · MITRE source
CWE-842Placement of User into Incorrect Group
The product or the administrator places a user into an incorrect group.
If the incorrect group has more access or privileges than the intended group, the user might be able to bypass intended security policy to access unexpected resources or perform unexpected actions. The access-control system might not be able to detect malicious usage of this group membership.
Last updated: 20 August 2026 13:14 UTC
Cumulative inbound coverage
How completely the frameworks we cross-walk collectively cover this — the verdict is the strongest single mapping (overlapping partials are not summed); breadth shows the corroboration behind it.
Collective: mostly · 7 mapping(s) from 5 framework(s): STIG windows server 2016 2 (mostly) · STIG windows server 2019 2 (mostly) · STIG windows 10 1 (mostly) · STIG windows 11 1 (mostly) · STIG windows server 2022 1 (mostly)
Control responseHuman-reviewed
Answering this weakness across the control lifecycle, from our framework cross-walks.
NIST 800-53 r5 controls that address this weakness (0)AI-assisted
| Control | Title | Family | Why it addresses this CWE |
|---|---|---|---|
| No NIST controls proposed yet. | |||
Top CVEs of this weakness type, ranked by Risk Priority
| CVE | Risk | CVSS | EPSS | Published |
|---|---|---|---|---|
CVE-2024-25632 UPD | 6.5 | 8.6 | 0.0040 | 2024-10-01 |
CVE-2024-10082 UPD | 6.2 | 8.7 | 0.0048 | 2024-11-06 |
CVE-2022-3650 UPD | 5.8 | 7.8 | 0.0033 | 2023-01-17 |
CVE-2023-25575 UPD | 5.7 | 7.7 | 0.0060 | 2023-02-28 |
CVE-2022-31007 UPD | 5.4 | 4.9 | 0.2695 | 2022-05-31 |
CVE-2022-2990 UPD | 5.4 | 7.1 | 0.0034 | 2022-09-13 |
CVE-2022-2989 UPD | 5.3 | 7.1 | 0.0031 | 2022-09-13 |
CVE-2022-45097 UPD | 5.0 | 6.3 | 0.0041 | 2023-02-01 |