CWE-1220: Insufficient Granularity of Access Control
The product implements access controls via a policy or other feature with the intention to disable or restrict accesses (reads and/or writes) to assets in a system from untrusted agents. However, implemented access controls lack the required granularity
A kind of CWE-284 Improper Access Control.
From the CWE List. © The MITRE Corporation.
Newest
- immich-app immich Immich calendar heatmap endpoint discloses cross-user activity through broken access control 4.3 Medium
- zohocorp manageengine key manager plus Improper access control vulnerability 7.7 High
- zohocorp manageengine key manager plus Improper access control vulnerability 7.1 High
- zohocorp manageengine key manager plus Improper access control vulnerability 7.1 High
- gitea Gitea limited-visibility profile disclosure with public-only tokens 4.3 Medium
- asterisk, asterisk certified-asterisk +1 more Asterisk: ARI setChannelVar bypasses live_dangerously and permits FILE() writes 8.1 High
- grafana enterprise Cross-organization user modification and deletion via the SCIM API in Grafana Enterprise 6.7 Medium
- apache camel Apache Camel: Camel-Platform-HTTP Unintended Proxy Mode via Prefix Path Matching 4.8 Medium
- thorsten phpmyfaq phpMyFAQ 4.2.0-alpha before 4.2.0-beta Missing Authorization via deleteGroup API 7.0 High
- perforce p4 (helix core) Credential Disclosure in P4 Search Configuration API 8.5 High
- gitea Gitea private attachment disclosure through repository mismatch 5.9 Medium
- microsoft windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 +22 more +24 more Windows Mobile Device Management Tampering Vulnerability 5.5 Medium
- microsoft windows 10 version 1607, windows 10 version 1809, windows server 2012 +12 more +14 more Windows Server Update Service Elevation of Privilege Vulnerability 7.8 High
- microsoft windows 10 version 1607, windows 10 version 1809, windows server 2012 +12 more +14 more Windows Server Update Service Elevation of Privilege Vulnerability 7.8 High
- microsoft windows 11 version 24h2, windows 11 version 25h2, windows 11 version 26h1 +5 more +7 more Windows StateRepository API Elevation of Privilege Vulnerability 7.8 High
- grafana enterprise, oss +1 more Azure Monitor data source resource proxy allows calls to arbitrary Azure Resource Manager APIs 6.3 Medium
- gitlab Insufficient Granularity of Access Control in GitLab 4.3 Medium
- drupal webform Webform - Moderately critical - Access bypass - SA-CONTRIB-2026-167 5.4 Medium
- ash-project ash Ash field policies do not filter-nil forbidden calculations and aggregates, enabling an information-disclosure oracle 6.0 Medium
- aws iam-identity-center-team Incorrect privilege assignment in Temporary Elevated Access Management (TEAM) for AWS IAM Identity Center 8.6 High
- microsoft sql server 2017 (cu 31), sql server 2017 (gdr), sql server 2019 (cu 32) +9 more +11 more SQL Server Elevation of Privilege Vulnerability 8.8 High
- microsoft sql server 2017 (cu 31), sql server 2017 (gdr), sql server 2019 (cu 32) +9 more +11 more Microsoft SQL Server Elevation of Privilege Vulnerability 8.8 High
- microsoft windows 10 version 1809, windows 10 version 21h2, windows 10 version 22h2 +16 more +18 more Windows Connected User Experiences and Telemetry Information Disclosure Vulnerability 6.5 Medium
- ash-project ash lua AshLua eval read operations can read field-policy-protected fields via aggregates 6.0 Medium
- ash-project ash ai AshAi aggregate tool can read field-policy-protected fields 6.0 Medium
- hp inc. support assistant HP Support Assistant – Potential Escalation of Privilege 7.3 High
- tecnativa docker-socket-proxy docker-socket-proxy through 0.5.0 Insufficient Access Control Granularity Exposes Container Filesystems 8.3 High
- beyondtrust endpoint privilege management (windows deployment) Control protections bypass in BeyondTrust Endpoint Privilege Management (Windows deployment) support utility 7.1 High
- apache apache-airflow-providers-google, apache software foundation airflow google provider +1 more Apache Airflow Google provider: google Secret Manager backend: team scope is never applied, exposing every team's Connections and Variables 6.5 Medium
- microsoft windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 +24 more +26 more Windows User-Mode Power Service (UMPS) Elevation of Privilege Vulnerability 7.8 High
-
intel-microcodeDebian,intel-ucodeAlpaquita,microcodeMageia +2 more +4 more Insufficient granularity of access control in some subsystem for some Intel(R) Xeon(R) 6 Scalable... 4.3 Medium - red hat directory server 11, directory server 12, directory server 13 +5 more +7 more 389-ds-base: 389-ds-base: heap-buffer-overflow in rdn_av_swap on quoted multivalued rdn 5.3 Medium
- red hat build of keycloak 26.6, build of keycloak 26.6.7, data grid 8 +3 more +5 more Keycloak-services: keycloak-services: incorrect authorization in admin role-composite deletion allows delegated admin to remove privileged child roles 4.9 Medium
- red hat build of keycloak 26.6, build of keycloak 26.6.7, data grid 8 +3 more +5 more Keycloak-services: keycloak-services: realm default-group reads disclose hidden groups under fgap v2 4.3 Medium
- microsoft windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 +22 more +24 more Windows Event Logging Service Remote Code Execution Vulnerability 8.0 High
- microsoft windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 +22 more +24 more Windows Filtering Platform Elevation of Privilege Vulnerability 7.8 High
- microsoft surface go, surface hub, surface laptop go +33 more +35 more Surface Broker SDMA Elevation of Privilege Vulnerability 7.8 High
- microsoft active directory federation services, windows 10 version 1607, windows 10 version 1809 +13 more +15 more Active Directory Federation Services Elevation of Privilege Vulnerability 7.8 High
- microsoft exchange server, exchange server subscription edition, exchange server 2016 cumulative update 23 +3 more +5 more Microsoft Exchange Server Elevation of Privilege Vulnerability 7.8 High
- microsoft windows 10 version 1809, windows 10 version 21h2, windows 10 version 22h2 +14 more +16 more Windows StateRepository API Server file Elevation of Privilege Vulnerability 7.8 High
- red hat build of keycloak 26.4, build of keycloak 26.4.14, build of keycloak 26.6 +2 more +4 more Keycloak-services: keycloak: fgap v2 parent group children endpoint bypasses per-child view permission filter 4.3 Medium
- red hat build of keycloak, build of keycloak 26.6, build of keycloak 26.6.6 +3 more +5 more Keycloak-services: keycloak-services: keycloak: fgap v2 role groups endpoint discloses hidden group metadata without group view permission 4.3 Medium
- red hat build of keycloak 26.4, build of keycloak 26.4.13, build of keycloak 26.6 +1 more +3 more Keycloak: keycloak: information disclosure due to user profile permission bypass 2.7 Low
- amd athlon™ 3000 series desktop processors with radeon™ graphics, athlon™ 3000 series mobile processors with radeon™ graphics, radeon™ pro v520 +24 more +26 more Insufficient granularity of access control in ASP (AMD Secure Processor) may allow an attacker... 7.1 High
- lfprojects mlflow, mlflow mlflow/mlflow, red hat openshift ai (rhoai) +2 more Missing Authorization Validation in mlflow/mlflow 9.0 Critical
- red hat build of keycloak 26.4, build of keycloak 26.4.12, redhat build of keycloak +2 more Keycloak: org.keycloak.authorization: keycloak: information disclosure via broken access control in user lookup endpoint 4.3 Medium
- amd epyc™ 7002 series processors, epyc™ embedded 7002 series processors, ryzen embedded v2000a series processors +31 more +33 more Improper isolation of shared resources within the CPU operation cache on Zen 2-based products... 7.3 High
- amd athlon™ 3000 series mobile processors with radeon™ graphics, epyc™ 4004 series processors, epyc™ 4005 series processors +25 more +27 more Improper Input Validation in the AMD RAID driver could allow an attacker to point to an arbitrary... 8.6 High
- microsoft office, 365 apps, 365 apps for enterprise +4 more +6 more Microsoft Office Click-To-Run Elevation of Privilege Vulnerability 8.8 High
- microsoft sharepoint server, sharepoint enterprise server 2016, sharepoint server 2019 +1 more +3 more Microsoft SharePoint Server Remote Code Execution Vulnerability 8.8 High
- Show olderLoading…