CWE-1220: Insufficient Granularity of Access Control
The product implements access controls via a policy or other feature with the intention to disable or restrict accesses (reads and/or writes) to assets in a system from untrusted agents. However, implemented access controls lack the required granularity
A kind of CWE-284 Improper Access Control.
From the CWE List. © The MITRE Corporation.
Newest
- gitlabInsufficient Granularity of Access Control in GitLab6.4 Medium
- argoproj argo-helmHelm Lacks Granularity in Workflow Role2.8 Low
- argoproj argo-helmArgo Workflows Chart: Excessive Privileges in Workflow Role8.3 High
- microsoft outlook for android, outlook +1 moreOutlook for Android Elevation of Privilege Vulnerability5.7 Medium
- phpcgi.force_redirect configuration is bypassable due to the environment variable collision7.5 High
- lunary, lunary-ai lunary-ai/lunary, lunary-ai\/lunary +2 moreInformation Disclosure in lunary-ai/lunary4.3 Medium
- drupal paragraphs table, paragraphs table project table +1 moreParagraphs table - Critical - Access bypass, Information Disclosure - SA-CONTRIB-2024-0366.3 Medium
- asterisk, asterisk certified asterisk +1 moreAsterisk allows `Write=originate` as sufficient permissions for code execution / `System()` dialplan7.4 High
- aimeos ai-admin-graphqlaimeos/ai-admin-graphql improper access control vulnerability allows editors to manage own services3.8 Low
- aimeos ai-admin-graphqlaimeos/ai-admin-graphql improper access control vulnerability allows an editor to modify admin account7.1 High
- lunary, lunary-ai lunary-ai/lunary +1 moreInsufficient Access Control in lunary-ai/lunary5.7 Medium
- zenml, zenml-io zenml-io/zenml +1 moreImproper Authorization in zenml-io/zenml6.5 Medium
- drupal email contact, email contact project contact +1 moreEmail Contact - Moderately critical - Access bypass - SA-CONTRIB-2024-0207.5 High
- intel power gadget, power gadget software +1 moreImproper access control in Intel(R) Power Gadget software for Windows all versions may allow an...8.8 High
- intel power gadget, power gadget software +1 moreImproper access control in some Intel(R) Power Gadget software for macOS all versions may allow...8.8 High
- kimaiAPI returns timesheet entries a user should not be authorized to view6.8 Medium
- opentext asset management x (amx), service management automation x (smax) +1 morePotential Insufficient Access Control vulnerability has been identified in OpenText™ SMAX/AMX products.6.5 Medium
- red hat openstack platform 16.1, openstack platform 16.2, openstack platform 17.1 +4 more +6 moreTripleo-ansible: bind keys are world readable5.5 Medium
- microsoft edge, edge for android +1 moreMicrosoft Edge (Chromium-based) Security Feature Bypass Vulnerability3.9 Low
- heimavista epage, rpage +1 moreHeimavista Rpage and Epage - Broken Access Control5.3 Medium
- specklesystems speckle server, speckle-server +1 moreSpeckle Server API Token Privilege Escalation6.5 Medium
- dell powerprotect dd, apex protection storage, emc data domain os +3 more +5 moreDell PowerProtect DD, versions prior to 7.13.0.10, LTS 7.7.5.25, LTS 7.10.1.15, 6.2.1.110...7.8 High
- ibm spectrum fusion hci, storage fusion hci +1 moreIBM Spectrum Fusion HCI improper access control6.5 Medium
- red hat rhol-5.5-rhel-8, rhol-5.6-rhel-8, rhol-5.7-rhel-8 +1 more +3 moreOpenshift-logging: lokistack authorisation is cached too broadly5.7 Medium
- postgresql, debian linux, red hat enterprise linux 6 +7 more +9 morePostgresql: merge fails to enforce update or select row security policies3.1 Low
- microsoft .net, .net 6.0, .net 7.0 +7 more +9 more.NET and Visual Studio Elevation of Privilege Vulnerability8.1 High
- fossbilling, fossbilling fossbilling/fossbilling +1 moreInsufficient Granularity of Access Control in fossbilling/fossbilling5.4 Medium
- nvidia connectx firmwareNVIDIA ConnectX-5, ConnectX-6, and ConnectX6-DX contain a vulnerability in the NIC firmware,...5.0 Medium
- nvidia connectx firmwareNVIDIA ConnectX-5, ConnectX-6, and ConnectX6-DX contain a vulnerability in the NIC firmware,...5.0 Medium
- miniflux project miniflux, miniflux v2 +1 moreUnauthenticated Miniflux user can bypass allowed networks check to obtain Prometheus metrics7.5 High
- usememos memos, usememos/memos +1 moreInsufficient Granularity of Access Control in usememos/memos8.6 High
- usememos memos, usememos/memos +1 moreInsufficient Granularity of Access Control in usememos/memos8.2 High
- haas cnc controller, haascnc haas controller firmware +1 moreHaas Controller version 100.20.000.1110 has insufficient granularity of access control when using...9.8 Critical
- gravitl netmakerNetmaker vulnerable to Insufficient Granularity of Access Control8.8 High
- open-emr openemr, openemr openemr/openemr +1 moreNon Privilege User can Enable or Disable Registered in openemr/openemr8.1 High
- open-emr openemr, openemr openemr/openemr +1 moreAccounting User Can Download Patient Reports in openemr in openemr/openemr6.5 Medium
- argoproj argo cd, argo-cd +1 moreImproper access control allows admin privilege escalation in Argo CD9.9 Critical
- argoproj argo cdArgo CD improper access control bug can allow malicious user to escalate privileges to admin level8.8 High
- juniper junos, juniper networks junos os +1 moreJunos OS: SRX Series: Under a specific device configuration an attacker can access the devices J-Web management services from any interface, regardless of security settings protecting the service7.2 High
- microsoft windows, windows 10 version 1809, windows 10 version 1909 +8 more +10 moreWindows Elevation of Privilege Vulnerability7.8 High
- jsdom project jsdomWithdrawn Advisory: Insufficient Granularity of Access Control in JSDom5.6 Medium