Weakness (CWE)
CWE-1220: Insufficient Granularity of Access Control
The product implements access controls via a policy or other feature with the intention to disable or restrict accesses (reads and/or writes) to assets in a system from untrusted agents. However, implemented access controls lack the required granularity
How to prevent it (1 mitigation)
-
Architecture and Design, Implementation, Testing
- Access-control-policy protections must be reviewed for design inconsistency and common weaknesses.
- Access-control-policy definition and programming flow must be tested in pre-silicon, post-silicon testing.
Source: MITRE CWE-1220
9 results · Clear filters · Feed
-
Critical 9.0
Missing Authorization Validation in mlflow/mlflow
A vulnerability in MLflow versions <=3.10.1.dev0 allows unauthorized access to multipart upload (MPU) endpoints when the `--serve-artifacts` mode is enabled. The authorization logic does not enforce resource-level permission checks for `/mlflow-artifacts/mpu/…
-
Critical 9.6CVE-2026-6356 Public exploit
CVE-2026-6356
A vulnerability in the web application allows standard users to escalate their privileges to those of a super administrator through parameter manipulation, enabling them to access and modify sensitive information.
-
Critical 9.9
Paperclip: Cross-tenant agent API token minting via missing assertCompanyAccess on /api/agents/:id/keys
<img width="7007" height="950" alt="01-setup" src="https://github.com/user-attachments/assets/1596b8d1-8de5-4c21-b1d2-2db41b568d7e" /> > Isolated paperclip instance running in authenticated mode (default config) > on a clean Docker image matching commit b649b…
-
Critical 9.1
Argocd-image-updater: argocd image updater: cross-namespace privilege escalation via insufficient namespace validation
A flaw was found in ArgoCD Image Updater. This vulnerability allows an attacker, with permissions to create or modify an ImageUpdater resource in a multi-tenant environment, to bypass namespace boundaries. By exploiting insufficient validation, the attacker c…
-
Critical 9.1
Freeipa: idm: privilege escalation from host to domain admin in freeipa
A privilege escalation flaw from host to domain administrator was found in FreeIPA. This vulnerability is similar to CVE-2025-4404, where it fails to validate the uniqueness of the krbCanonicalName. While the previously released version added validations for …
-
Critical 9.1CVE-2025-4404 Public exploit
Freeipa: idm: privilege escalation from host to domain admin in freeipa
A privilege escalation from host to domain vulnerability was found in the FreeIPA project. The FreeIPA package fails to validate the uniqueness of the `krbCanonicalName` for the admin account by default, allowing users to create services with the same canonic…
-
Critical 9.8
This issue was addressed by removing the vulnerable code. This issue is fixed in iOS 18.4.1 and iPadOS 18.4.1, macOS Se…
KEV Apr 17, 2025 -
Critical 9.8
Haas Controller version 100.20.000.1110 has insufficient granularity of access control when using the "Ethernet Q Comma…
-
Critical 9.9
Improper access control allows admin privilege escalation in Argo CD
All unpatched versions of Argo CD starting with v1.0.0 are vulnerable to an improper access control bug, allowing a malicious user to potentially escalate their privileges to admin-level.