Skip to content
OpenAdvisories

Weakness (CWE)

CWE-1220: Insufficient Granularity of Access Control

Base Incomplete

The product implements access controls via a policy or other feature with the intention to disable or restrict accesses (reads and/or writes) to assets in a system from untrusted agents. However, implemented access controls lack the required granularity

How to prevent it (1 mitigation)

  1. Architecture and Design, Implementation, Testing

    - Access-control-policy protections must be reviewed for design inconsistency and common weaknesses.

    - Access-control-policy definition and programming flow must be tested in pre-silicon, post-silicon testing.

Source: MITRE CWE-1220

All Critical High Medium Low Exploited only Public exploit

8 results · Clear filters · Feed

  • Medium 4.8
    CVE-2026-85316 Public exploit

    Apache Camel: Camel-Platform-HTTP Unintended Proxy Mode via Prefix Path Matching

    Insufficient Granularity of Access Control vulnerability in Apache Camel Platform HTTP component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1. The component decided whether an endpoint ran in proxy mode by testing whet…

    Apache Software Foundation Apache Camel
  • High 7.4
    CVE-2026-78122 Public exploit

    docker-socket-proxy through 0.5.0 Insufficient Access Control Granularity Exposes Container Filesystems

    docker-socket-proxy fails to properly gate read endpoints in the /containers Docker API namespace when the CONTAINERS environment variable is set. Attackers can use GET requests to /containers/{id}/archive, /containers/{id}/export, /containers/{id}/logs, and …

    Tecnativa docker-socket-proxy
  • Critical 9.6
    CVE-2026-6356 Public exploit

    CVE-2026-6356

    A vulnerability in the web application allows standard users to escalate their privileges to those of a super administrator through parameter manipulation, enabling them to access and modify sensitive information.

    Augmentt Augmentt
  • High 7.8
    CVE-2026-33825 Exploited · Ransomware Public exploit

    Microsoft Defender Elevation of Privilege Vulnerability

    Insufficient granularity of access control in Microsoft Defender allows an authorized attacker to elevate privileges locally.

    Microsoft Microsoft Defender Antimalware Platform
    KEV Apr 22, 2026
  • High 8.2
    CVE-2026-39363 Public exploit

    Vite Affected by Arbitrary File Read via Vite Dev Server WebSocket

    Vite is a frontend tooling framework for JavaScript. From 6.0.0 to before 6.4.2, 7.3.2, and 8.0.5, if it is possible to connect to the Vite dev server’s WebSocket without an Origin header, an attacker can invoke fetchModule via the custom WebSocket event vite…

    vitejs vite vite-plus vite npm
  • Critical 9.1
    CVE-2025-4404 Public exploit

    Freeipa: idm: privilege escalation from host to domain admin in freeipa

    A privilege escalation from host to domain vulnerability was found in the FreeIPA project. The FreeIPA package fails to validate the uniqueness of the `krbCanonicalName` for the admin account by default, allowing users to create services with the same canonic…

    Red Hat Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 6 Linux Debian Ubuntu
  • High 7.4
    CVE-2024-42365 Public exploit

    Asterisk allows `Write=originate` as sufficient permissions for code execution / `System()` dialplan

    Asterisk is an open source private branch exchange (PBX) and telephony toolkit. Prior to asterisk versions 18.24.2, 20.9.2, and 21.4.2 and certified-asterisk versions 18.9-cert11 and 20.7-cert2, an AMI user with `write=originate` may change all configuration …

    asterisk asterisk asterisk asterisk Debian Ubuntu Alpine
  • Medium 6.5
    CVE-2023-43040 Public exploit

    IBM Spectrum Fusion HCI improper access control

    IBM Spectrum Fusion HCI 2.5.2 through 2.7.2 could allow an attacker to perform unauthorized actions in RGW for Ceph due to improper bucket access. IBM X-Force ID: 266807.

    IBM Spectrum Fusion HCI ceph ceph Debian Ubuntu