cve.bz

CWE-1220: Insufficient Granularity of Access Control

Filter

The product implements access controls via a policy or other feature with the intention to disable or restrict accesses (reads and/or writes) to assets in a system from untrusted agents. However, implemented access controls lack the required granularity

What the weakness is: CWE-1220 at MITRE

Ask an AI about CWE-1220

ChatGPTClaudePerplexityGoogle AI Mode

Show the promptExplain CWE-1220: Insufficient Granularity of Access Control and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/1220.html and https://cve.bz/cve/cwe/1220?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. –CVE-2026-119627EPSS 0.3%

    The web profile and RSS/Atom feed routes of users and organizations checked only whether a signed-in viewer could see a limited-visibility owner, without considering the `public-only` restriction of the personal access token used to authen…

  2. 8.1CVE-2026-57202EPSS 0.4%

    Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3, an authenticated Asterisk REST Interface (ARI) attacker with read…

  3. 5.4CVE-2026-96372EPSS 0.2%

    Insufficient Granularity of Access Control vulnerability in Drupal Webform allows Forceful Browsing. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.

  4. 6.7CVE-2026-92539EPSS 0.3%

    A service account with user-management permissions in one organization can read, modify, disable or delete users belonging to other organizations on the same Grafana instance through the SCIM API (insecure direct object reference). Only Gr…

  5. 4.8CVE-2026-85316EPSS 0.2%

    Insufficient Granularity of Access Control vulnerability in Apache Camel Platform HTTP component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1. The component decided whether an endpoint ran in prox…

  6. 7.0CVE-2026-111885EPSS 0.3%

    phpMyFAQ from 4.2.0-alpha before 4.2.0-beta contains a missing authorization vulnerability in GroupController::deleteGroup() that omits privilege-level checks on target groups. Authenticated non-SuperAdmin administrators holding GROUP_DELE…

  7. 8.5CVE-2026-103509EPSS 0.2%

    P4 Search (formerly Helix Search) returns stored credentials in cleartext through its configuration API to users with administrative privileges on the connected P4 Server, allowing privilege escalation. This affects 2026.4.2 and earlier an…

  8. 5.9CVE-2026-78433EPSS 0.4%

    Gitea's web attachment handler skips its cross-repository ownership check for attachments created before 16 January 2026 and checks permissions against the repository named in the request URL instead. An unauthenticated attacker who knows …

  9. 7.8CVE-2026-83499EPSS 0.3%

    Insufficient granularity of access control in Windows Server Update Service allows an authorized attacker to elevate privileges locally.

  10. 7.8CVE-2026-81969EPSS 0.3%

    Insufficient granularity of access control in Windows Server Update Service allows an authorized attacker to elevate privileges locally.

  11. 7.8CVE-2026-70218EPSS 0.4%

    Insufficient granularity of access control in Windows StateRepository API allows an authorized attacker to elevate privileges locally.

  12. 5.5CVE-2026-70216EPSS 0.3%

    Insufficient granularity of access control in Windows Mobile Device Management allows an authorized attacker to perform tampering locally.

  13. 6.3CVE-2026-93294EPSS 0.3%

    A user with query access to an Azure Monitor data source can use its resource proxy to call Azure Resource Manager APIs beyond those Grafana needs, with the data source's Azure identity (unintended proxy). The impact is bounded by the Azur…

  14. 4.3CVE-2026-14210EPSS 0.2%

    GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.11 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an authenticated user with a project-scoped fine-…

  15. 6.0CVE-2026-86338EPSS 0.4%

    Ash field_policies are documented to protect against filter-based information disclosure: when a field the actor may not see is referenced in a filter, it is replaced with an expression that evaluates to nil, so a filter cannot be used as …

  16. 8.6CVE-2026-86830EPSS 0.7%

    Incorrect privilege assignment in Temporary Elevated Access Management (TEAM) for AWS IAM Identity Center solution before version 1.5.1 might allow an authenticated remote user with application-level access to read, approve, modify, or rev…

  17. 8.8CVE-2026-77480EPSS 0.8%

    Insufficient granularity of access control in SQL Server allows an authorized attacker to elevate privileges over a network.

  18. 6.5CVE-2026-69267EPSS 0.4%

    Insufficient granularity of access control in Windows Connected User Experiences and Telemetry allows an authorized attacker to disclose information locally.

  19. 8.8CVE-2026-66814EPSS 0.8%

    Insufficient granularity of access control in SQL Server allows an authorized attacker to elevate privileges over a network.

  20. 6.0CVE-2026-78230EPSS 0.4%

    AshAi exposes Ash read actions to language-model tool calls. The read tool accepts an aggregate result type (min, max, sum, avg) that builds an ad-hoc Ash.Query.Aggregate over a named field and returns its raw value. Ash field policies re…

  21. 6.0CVE-2026-78216EPSS 0.4%

    AshLua exposes Ash read actions to Lua scripts run through an eval action. A read call accepts an operation (list, min, max, first, sum, avg) that builds an ad-hoc Ash.Query.Aggregate over a named field and returns its raw value. Ash fiel…

  22. 7.3CVE-2026-15431EPSS 0.1%

    A potential security vulnerability has been identified in the HP Support Assistant for versions prior to 9.53.2.0. The vulnerability could potentially allow a local attacker to escalate privileges due to insufficient acces…

  23. 8.3CVE-2026-78122EPSS 0.3%

    docker-socket-proxy fails to properly gate read endpoints in the /containers Docker API namespace when the CONTAINERS environment variable is set. Attackers can use GET requests to /containers/{id}/archive, /containers/{id}/export, /contai…

  24. 7.1CVE-2026-40145EPSS 0.2%

    A vulnerability exists in the interaction between a Endpoint Privilege Management (Windows Deployment) support utility and the agent's tamper protection controls. Under certain conditions, the protections applied to the utility process may…

  25. 6.5CVE-2026-68868EPSS 0.6%

    The Google Cloud Secret Manager secrets backend in Apache Airflow's Google provider never applied the team scope when resolving Connections and Variables: the caller's `team_name` was accepted by the backend but dropped at the internal cal…

  26. 7.8CVE-2026-62721EPSS 0.3%

    Insufficient granularity of access control in User-Mode Power Service (UMPS) allows an authorized attacker to elevate privileges locally.

  27. 4.3CVE-2025-31938EPSS 0.09%

    Insufficient granularity of access control in some subsystem for some Intel(R) Xeon(R) 6 Scalable processors with Intel(R) TDX may allow an information disclosure. Authorized adversary with an authenticated user combined with a high comple…

  28. 5.3CVE-2026-16560EPSS 0.4%

    A heap-buffer-overflow flaw was found in Directory Server (389-ds-base). When a DN contains a legacy-quoted value, the server won't close the heap allocation allowing another call to refer to the same memory pointer causing a denial of ser…

  29. 6.5CVE-2026-16108EPSS 0.4%

    A flaw was found in the default-groups REST endpoint and realm representation of Keycloak. This component is responsible for managing groups that are automatically assigned to new users within a realm. The issue allows a delegated administ…

  30. 4.9CVE-2026-16106EPSS 0.4%

    A flaw was found in the admin REST API of Keycloak, a solution for identity and access management. The issue occurs when a delegated administrator attempts to remove a child role from a composite role. Due to missing authorization checks, …

  31. 8.8CVE-2026-50502EPSS 0.7%

    Insufficient granularity of access control in Windows Event Logging Service allows an authorized attacker to execute code over a network.

  32. 7.8CVE-2026-50405EPSS 0.3%

    Insufficient granularity of access control in Windows Filtering Platform (WFP) allows an authorized attacker to elevate privileges locally.

  33. 7.8CVE-2026-56155KEVEPSS 0.3%

    Insufficient granularity of access control in Active Directory Federation Services (AD FS) allows an authorized attacker to elevate privileges locally.

  34. 7.8CVE-2026-55006EPSS 0.3%

    Insufficient granularity of access control in Microsoft Exchange Server allows an authorized attacker to elevate privileges locally.

  35. 7.8CVE-2026-49170EPSS 0.3%

    Insufficient granularity of access control in Windows StateRepository API allows an authorized attacker to elevate privileges locally.

  36. 7.8CVE-2026-48581EPSS 0.3%

    Insufficient granularity of access control in Microsoft Surface allows an authorized attacker to elevate privileges locally.

  37. 2.7CVE-2026-14615EPSS 0.4%

    A flaw was found in the Fine-Grained Admin Permissions (FGAP) v2 implementation within Keycloak's administrative services. When FGAP v2 is enabled, the system fails to properly filter child groups based on the caller's specific permissions…

  38. 4.9CVE-2026-14613EPSS 0.4%

    A vulnerability was discovered in Keycloak's administrative interface that allows certain administrators to see information about groups they shouldn't have access to. When the new Fine-Grained Admin Permissions (FGAP v2) are turned on, an…

  39. 2.7CVE-2026-9088EPSS 0.3%

    A flaw was found in org.keycloak.services. An administrator with delegated access to read group memberships and users can bypass user profile permissions by accessing the group members endpoint. This allows the administrator to view user a…

  40. 7.1CVE-2021-46747EPSS 0.10%

    Insufficient granularity of access control in ASP (AMD Secure Processor) may allow an attacker with an untrusted user space application to map sensitive SMN (System Management Network) apertures leading to a potential escalation of privile…

  41. 9.0CVE-2026-2651EPSS 0.3%

    A vulnerability in MLflow versions <=3.10.1.dev0 allows unauthorized access to multipart upload (MPU) endpoints when the `--serve-artifacts` mode is enabled. The authorization logic does not enforce resource-level permission checks for `/m…

  42. 4.3CVE-2026-37981EPSS 0.4%

    A flaw was found in Keycloak. A broken access control vulnerability in the Account Resources user lookup endpoint allows a remote authenticated user, who owns at least one User-Managed Access (UMA) resource, to enumerate and harvest person…

  43. 7.3CVE-2025-54518EPSS 0.3%

    Improper isolation of shared resources within the CPU operation cache on Zen 2-based products could allow an attacker to corrupt instructions executed at a different privilege level, potentially resulting in privilege escalation.

  44. 8.6CVE-2024-21962EPSS 0.1%

    Improper Input Validation in the AMD RAID driver could allow an attacker to point to an arbitrary memory location potentially resulting in privilege escalation and arbitrary code execution.

  45. 8.8CVE-2026-40365EPSS 1.0%

    Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.

  46. 8.8CVE-2026-35436EPSS 0.2%

    Use after free in Microsoft Office allows an authorized attacker to elevate privileges locally.

  47. 7.5CVE-2026-40981EPSS 0.4%

    When using Google Secrets Manager as a backend for the Spring Cloud Config server a client can craft a request to the config server potentially exposing secrets from unintended GCP projects. Spring Cloud Config 3.1.x: affected from 3.1.0 t…

  48. 8.2CVE-2026-41326EPSS 0.3%

    Kata Containers is an open source project focusing on a standard implementation of lightweight Virtual Machines (VMs) that perform like containers. From v3.4.0 to v3.28.0, an oversight in the CopyFile policy (and perhaps the CopyFile handl…

  49. 4.3CVE-2026-40690EPSS 0.4%

    The asset dependency graph did not restrict nodes by the viewer's DAG read permissions: a user with read access to at least one DAG could browse the asset graph for any other asset in the deployment and learn the existence and names of DAG…

  50. 4.3CVE-2026-38743EPSS 0.4%

    The authenticated /ui/dags endpoint did not enforce per-DAG access control on embedded Human-in-the-Loop (HITL) and TaskInstance records: a logged-in Airflow user with read access to at least one DAG could retrieve HITL prompts (including …