cve.bz

CWE-1220: Insufficient Granularity of Access Control, page 2

Filter

The product implements access controls via a policy or other feature with the intention to disable or restrict accesses (reads and/or writes) to assets in a system from untrusted agents. However, implemented access controls lack the required granularity

What the weakness is: CWE-1220 at MITRE

Ask an AI about CWE-1220

ChatGPTClaudePerplexityGoogle AI Mode

Show the promptExplain CWE-1220: Insufficient Granularity of Access Control and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/1220.html and https://cve.bz/cve/cwe/1220?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 9.6CVE-2026-6356EPSS 0.3%

    A vulnerability in the web application allows standard users to escalate their privileges to those of a super administrator through parameter manipulation, enabling them to access and modify sensitive information.

  2. 9.1CVE-2026-6388EPSS 0.4%

    A flaw was found in ArgoCD Image Updater. This vulnerability allows an attacker, with permissions to create or modify an ImageUpdater resource in a multi-tenant environment, to bypass namespace boundaries. By exploiting insufficient valida…

  3. 7.8CVE-2026-33825KEVEPSS 6.7%

    Insufficient granularity of access control in Microsoft Defender allows an authorized attacker to elevate privileges locally.

  4. 6.9CVE-2025-20628EPSS 0.2%

    An insufficient granularity of access control vulnerability exists in PingIDM (formerly ForgeRock Identity Management) where administrators cannot properly configure access rules for Remote Connector Servers (RCS) running in client mode. T…

  5. 8.2CVE-2026-39363ExploitEPSS 3.4%

    Vite is a frontend tooling framework for JavaScript. From 6.0.0 to before 6.4.2, 7.3.2, and 8.0.5, if it is possible to connect to the Vite dev server’s WebSocket without an Origin header, an attacker can invoke fetchModule via the custom …

  6. 7.4CVE-2025-69196EPSS 0.4%

    FastMCP is the standard framework for building MCP applications. Prior to version 2.14.2, the server does not properly respect the resource parameter submitted by the client in the authorization and token request. Instead of issuing the to…

  7. 5.5CVE-2026-20107EPSS 0.10%

    A vulnerability in the Object Model CLI component of Cisco Application Policy Infrastructure Controller (APIC) could allow an authenticated, local attacker to cause an affected device to reload unexpectedly, resulting in a denial of servic…

  8. 4.6CVE-2025-48517EPSS 0.2%

    Insufficient Granularity of Access Control in SEV firmware could allow a privileged user with a malicious hypervisor to create a SEV-ES guest with an ASID in the range meant for SEV-SNP guests potentially resulting in a partial loss of con…

  9. 4.0CVE-2025-48514EPSS 0.2%

    Insufficient Granularity of Access Control in SEV firmware can allow a privileged attacker to create a SEV-ES Guest to attack SNP guest, potentially resulting in a loss of confidentiality.

  10. 7.0CVE-2025-35998EPSS 0.2%

    Missing protection mechanism for alternate hardware interface in the Intel(R) Quick Assist Technology for some Intel(R) Platforms within Ring 0: Kernel may allow an escalation of privilege. System software adversary with a privileged user …

  11. 4.8CVE-2026-0873EPSS 0.3%

    On a Cryptobox platform where administrator segregation based on entities is used, some vulnerabilities in Ercom Cryptobox administration console allows an authenticated entity administrator with knowledge to elevate his account to global …

  12. 6.5CVE-2024-4147EPSS 0.4%

    In lunary-ai/lunary version 1.2.13, an insufficient granularity of access control vulnerability allows users to delete prompts created in other organizations through ID manipulation. The vulnerability stems from the application's failure t…

  13. 5.4CVE-2025-11246EPSS 0.4%

    GitLab has remediated an issue in GitLab CE/EE affecting all versions from 15.4 before 18.5.5, 18.6 before 18.6.3, and 18.7 before 18.7.1 that could have allowed an authenticated user with specific permissions to remove all project runners…

  14. 5.1CVE-2025-8306EPSS 0.2%

    Asseco InfoMedica is a comprehensive solution used to manage both administrative and medical tasks in the healthcare sector. A low privileged user is able to obtain encoded passwords of all other accounts (including main administrator) due…

  15. 4.9CVE-2025-20305EPSS 0.3%

    A vulnerability in the web-based management interface of Cisco ISE could allow an authenticated, remote attacker to obtain sensitive information from an affected device. This vulnerability exists because certain files lack proper data p…

  16. 1.0CVE-2025-8053EPSS 0.3%

    Insufficient Granularity of Access Control vulnerability in opentext Flipper allows Exploiting Incorrectly Configured Access Control Security Levels. The vulnerability could allow a low privilege user to interact with the backend API witho…

  17. 2.3CVE-2025-8049EPSS 0.3%

    Insufficient Granularity of Access Control vulnerability in opentext Flipper allows Exploiting Incorrectly Configured Access Control Security Levels. The vulnerability could allow a low-privilege user to elevate privileges within the appli…

  18. 6.9CVE-2025-54461EPSS 0.3%

    ChatLuck contains an insufficient granularity of access control vulnerability in Invitation of Guest Users. If exploited, an uninvited guest user may register itself as a guest user.

  19. 9.1CVE-2025-7493EPSS 0.6%

    A privilege escalation flaw from host to domain administrator was found in FreeIPA. This vulnerability is similar to CVE-2025-4404, where it fails to validate the uniqueness of the krbCanonicalName. While the previously released version ad…

  20. 7.5CVE-2024-21947EPSS 0.1%

    Improper input validation in the system management mode (SMM) could allow a privileged attacker to overwrite arbitrary memory potentially resulting in arbitrary code execution at the SMM level.

  21. 4.6CVE-2025-31961EPSS 0.2%

    HCL Connections contains a broken access control vulnerability that may allow unauthorized user to update data in certain scenarios.

  22. 4.3CVE-2025-2498EPSS 0.3%

    An improper access control in Gitlab EE affecting all versions from 12.0 prior to 18.0.6, 18.1 prior to 18.1.4, and 18.2 prior to 18.2.2 that under certain conditions could have allowed users to view assigned issues from restricted groups …

  23. 7.3CVE-2025-22839EPSS 0.2%

    Insufficient granularity of access control in the OOB-MSM for some Intel(R) Xeon(R) 6 Scalable processors may allow a privileged user to potentially enable escalation of privilege via adjacent access.

  24. 2.7CVE-2025-7001EPSS 0.4%

    An issue has been discovered in GitLab CE/EE affecting all versions from 15.0 before 18.0.5, 18.1 before 18.1.3, and 18.2 before 18.2.1 that could have allowed priviledged users to access certain resource_group information through the API …

  25. 8.2CVE-2025-3648EPSS 1.7%

    A vulnerability has been identified in the Now Platform that could result in data being inferred without authorization. Under certain conditional access control list (ACL) configurations, this vulnerability could enable unauthenticated and…

  26. 4.9CVE-2025-27026EPSS 0.4%

    A missing double-check feature in the WebGUI for CLI deactivation in Infinera G42 version R6.1.3 allows an authenticated administrator to make other management interfaces unavailable via local and network interfaces. The CLI deactivation…

  27. 9.1CVE-2025-4404EPSS 2.0%

    A privilege escalation from host to domain vulnerability was found in the FreeIPA project. The FreeIPA package fails to validate the uniqueness of the `krbCanonicalName` for the admin account by default, allowing users to create services w…

  28. 7.5CVE-2025-5982EPSS 0.3%

    An issue has been discovered in GitLab EE affecting all versions from 12.0 before 17.10.8, 17.11 before 17.11.4, and 18.0 before 18.0.2. Under certain conditions users could bypass IP access restrictions and view sensitive information.

  29. 7.5CVE-2025-4979EPSS 0.4%

    An issue has been discovered in GitLab CE/EE affecting all versions before 17.10.7, 17.11 before 17.11.3, and 18.0 before 18.0.1. An attacker may be able to reveal masked or hidden CI variables (that they did not author) in the WebUI, by s…

  30. 4.3CVE-2025-1110EPSS 0.3%

    An issue has been discovered in GitLab CE/EE affecting all versions from 18.0 before 18.0.1. In certain circumstances, a user with limited permissions could access Job Data via a crafted GraphQL query.

  31. 5.5CVE-2025-32703EPSS 0.5%

    Insufficient granularity of access control in Visual Studio allows an authorized attacker to disclose information locally.

  32. 7.5CVE-2025-1278EPSS 0.4%

    An issue has been discovered in GitLab CE/EE affecting all versions from 12.0 before 17.9.8, 17.10 before 17.10.6, and 17.11 before 17.11.2. Under certain conditions users could bypass IP access restrictions and view sensitive information.

  33. 9.8CVE-2025-31201KEVEPSS 14%

    This issue was addressed by removing the vulnerable code. This issue is fixed in iOS 18.4.1 and iPadOS 18.4.1, macOS Sequoia 15.4.1, tvOS 18.4.1, visionOS 2.4.1. An attacker with arbitrary read and write capability may be able to bypass Po…

  34. 5.3CVE-2025-2408EPSS 0.3%

    An issue has been discovered in GitLab CE/EE affecting all versions from 13.12 before 17.8.7, 17.9 before 17.9.6, and 17.10 before 17.10.4. Under certain conditions users could bypass IP access restrictions and view sensitive information.

  35. 7.5CVE-2024-33058EPSS 0.10%

    Memory corruption while assigning memory from the source DDR memory(HLOS) to ADSP.

  36. 8.8CVE-2025-29987EPSS 0.5%

    Dell PowerProtect Data Domain with Data Domain Operating System (DD OS) versions prior to 8.3.0.15 contain an Insufficient Granularity of Access Control vulnerability. An authenticated user from a trusted remote client could exploit this v…

  37. 6.5CVE-2024-12619EPSS 0.3%

    An issue has been discovered in GitLab CE/EE affecting all versions from 16.0 before 17.8.6, 17.9 before 17.9.3, and 17.10 before 17.10.1, allowing internal users to gain unauthorized access to internal projects.

  38. 7.4CVE-2025-20111EPSS 0.3%

    A vulnerability in the health monitoring diagnostics of Cisco Nexus 3000 Series Switches and Cisco Nexus 9000 Series Switches in standalone NX-OS mode could allow an unauthenticated, adjacent attacker to cause the device to reload unexpect…

  39. 4.9CVE-2024-6696EPSS 0.4%

    The product implements access controls via a policy or other feature with the intention to disable or restrict accesses (reads and/or writes) to assets in a system from untrusted agents. However, implemented access controls lack required g…

  40. 6.8CVE-2024-39279EPSS 0.2%

    Insufficient granularity of access control in UEFI firmware in some Intel(R) processors may allow a authenticated user to potentially enable denial of service via local access.

  41. 5.5CVE-2024-21971EPSS 0.1%

    Improper input validation in AMD Crash Defender could allow an attacker to provide the Windows® system process ID to a kernel-mode driver, resulting in an operating system crash, potentially leading to denial of service.

  42. 7.5CVE-2023-31343EPSS 0.2%

    Improper input validation in the SMM handler may allow a privileged attacker to overwrite SMRAM, potentially leading to arbitrary code execution.

  43. 7.5CVE-2023-31342EPSS 0.2%

    Improper input validation in the SMM handler may allow a privileged attacker to overwrite SMRAM, potentially leading to arbitrary code execution.

  44. 7.8CVE-2024-53295EPSS 0.1%

    Dell PowerProtect DD versions prior to 8.3.0.0, 7.10.1.50, and 7.13.1.20 contain an improper access control vulnerability. A local malicious user with low privileges could potentially exploit this vulnerability leading to escalation of pri…

  45. 5.3CVE-2024-11931EPSS 0.3%

    An issue has been discovered in GitLab CE/EE affecting all versions starting from 17.0 prior to 17.6.4, from 17.7 prior to 17.7.3, and from 17.8 prior to 17.8.1. Under certain conditions, it may have been possible for users with developer …

  46. 6.3CVE-2024-13272EPSS 0.3%

    Insufficient Granularity of Access Control vulnerability in Drupal Paragraphs table allows Content Spoofing.This issue affects Paragraphs table: from 0.0.0 before 1.23.0, from 2.0.0 before 2.0.2.

  47. 7.5CVE-2024-13256EPSS 0.4%

    Insufficient Granularity of Access Control vulnerability in Drupal Email Contact allows Forceful Browsing.This issue affects Email Contact: from 0.0.0 before 2.0.4.

  48. 2.8CVE-2024-52814EPSS 0.2%

    Argo Helm is a collection of community maintained charts for `argoproj.github.io` projects. Prior to version 0.45.0, the `workflow-role`) lacks granularity in its privileges, giving permissions to `workflowtasksets` and `workflowartifactgc…

  49. 8.2CVE-2024-52799EPSS 0.2%

    Argo Workflows Chart is used to set up argo and its needed dependencies through one command. Prior to 0.44.0, the workflow-role has excessive privileges, the worst being create pods/exec, which will allow kubectl exec into any Pod in the s…

  50. 8.0CVE-2024-43604EPSS 1.2%

    Outlook for Android Elevation of Privilege Vulnerability