The product does not properly manage a user within its environment.
Users can be assigned to the wrong group (class) of permissions resulting in unintended access rights to sensitive objects.
CWE-284
CVE-2022-36109
Containerization product does not record a user's supplementary group ID, allowing bypass of group restrictions.
CVE-1999-1193
Operating system assigns user to privileged wheel group, allowing the user to gain root privileges.