Weakness (CWE)
CWE-1220: Insufficient Granularity of Access Control
The product implements access controls via a policy or other feature with the intention to disable or restrict accesses (reads and/or writes) to assets in a system from untrusted agents. However, implemented access controls lack the required granularity
How to prevent it (1 mitigation)
-
Architecture and Design, Implementation, Testing
- Access-control-policy protections must be reviewed for design inconsistency and common weaknesses.
- Access-control-policy definition and programming flow must be tested in pre-silicon, post-silicon testing.
Source: MITRE CWE-1220
62 results · Clear filters · Feed
-
High 7.5
Windows IKE Extension Spoofing Vulnerability
Insufficient granularity of access control in Windows IKE Extension allows an authorized attacker to perform spoofing locally.
-
High 8.8
Insufficient granularity of access control in the MigTD v2 policy evaluation engine for the Intel(R) TDX Migration Trus…
-
High 7.1
Cross-tenant sandbox takeover in SAP/astonish
In SAP/astonish, an authenticated user could potentially identify and operate on another team�s sandbox containers because of improper tenant isolation in the legacy Incus sandbox-management API handlers. The affected handlers did not use the tenant-aware ses…
-
High 8.1
SuperTokens Core: WebAuthn sign-in accepts a passkey across tenant boundaries
SuperTokens Core is an open source authentication server. From 10.1.0 until 11.0.9, 11.1.4, 11.2.4, 11.3.8, 11.4.8, 12.0.11, 12.1.2, 12.2.1, and 12.3.1, loadOptionsById_Transaction and getUserInfoByCredentialId_Transaction perform application-scoped WebAuthn …
-
High 7.7
Improper access control vulnerability
ManageEngine Key Manager Plus versions before 7151 were vulnerable to an Improper Access Control vulnerability that allowed authenticated low-privilege users to export keys outside their authorized scope.
-
High 7.1
Improper access control vulnerability
ZohoCorp ManageEngine Key Manager Plus versions up to 7150 allow authenticated users to export certificates belonging to other users to their own registered key vaults.
-
High 7.1
Improper access control vulnerability
ManageEngine Key Manager Plus versions before 7151 are vulnerable to an improper access control issue that allow authenticated users to modify another user's ACME certificate deployment credentials.
-
High 8.1
Asterisk: ARI setChannelVar bypasses live_dangerously and permits FILE() writes
Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3, an authenticated Asterisk REST Interface (ARI) attacker with read-only privileges may…
-
High 8.5
Credential Disclosure in P4 Search Configuration API
P4 Search (formerly Helix Search) returns stored credentials in cleartext through its configuration API to users with administrative privileges on the connected P4 Server, allowing privilege escalation. This affects 2026.4.2 and earlier and is fixed in 2026.4…
-
High 7.8
Windows Server Update Service Elevation of Privilege Vulnerability
Insufficient granularity of access control in Windows Server Update Service allows an authorized attacker to elevate privileges locally.
-
High 7.8
Windows Server Update Service Elevation of Privilege Vulnerability
Insufficient granularity of access control in Windows Server Update Service allows an authorized attacker to elevate privileges locally.
-
High 7.8
Windows StateRepository API Elevation of Privilege Vulnerability
Insufficient granularity of access control in Windows StateRepository API allows an authorized attacker to elevate privileges locally.
-
High 7.2
Incorrect privilege assignment in Temporary Elevated Access Management (TEAM) for AWS IAM Identity Center
Incorrect privilege assignment in Temporary Elevated Access Management (TEAM) for AWS IAM Identity Center solution before version 1.5.1 might allow an authenticated remote user with application-level access to read, approve, modify, or revoke arbitrary access…
-
High 8.8
SQL Server Elevation of Privilege Vulnerability
Insufficient granularity of access control in SQL Server allows an authorized attacker to elevate privileges over a network.
-
High 8.8
Microsoft SQL Server Elevation of Privilege Vulnerability
Insufficient granularity of access control in SQL Server allows an authorized attacker to elevate privileges over a network.
-
High 7.3
HP Support Assistant – Potential Escalation of Privilege
A potential security vulnerability has been identified in the HP Support Assistant for versions prior to 9.53.2.0. The vulnerability could potentially allow a local attacker to escalate privileges due to insufficient access controls.
-
High 7.4CVE-2026-78122 Public exploit
docker-socket-proxy through 0.5.0 Insufficient Access Control Granularity Exposes Container Filesystems
docker-socket-proxy fails to properly gate read endpoints in the /containers Docker API namespace when the CONTAINERS environment variable is set. Attackers can use GET requests to /containers/{id}/archive, /containers/{id}/export, /containers/{id}/logs, and …
-
High 7.1
Control protections bypass in BeyondTrust Endpoint Privilege Management (Windows deployment) support utility
A vulnerability exists in the interaction between a Endpoint Privilege Management (Windows Deployment) support utility and the agent's tamper protection controls. Under certain conditions, the protections applied to the utility process may not be enforced as …
-
High 7.8
Windows User-Mode Power Service (UMPS) Elevation of Privilege Vulnerability
Insufficient granularity of access control in User-Mode Power Service (UMPS) allows an authorized attacker to elevate privileges locally.
-
High 8.0
Windows Event Logging Service Remote Code Execution Vulnerability
Insufficient granularity of access control in Windows Event Logging Service allows an authorized attacker to execute code over a network.
-
High 7.8
Windows Filtering Platform Elevation of Privilege Vulnerability
Insufficient granularity of access control in Windows Filtering Platform (WFP) allows an authorized attacker to elevate privileges locally.
-
High 7.8
Surface Broker SDMA Elevation of Privilege Vulnerability
Insufficient granularity of access control in Microsoft Surface allows an authorized attacker to elevate privileges locally.
-
High 7.8CVE-2026-56155 Exploited
Active Directory Federation Services Elevation of Privilege Vulnerability
Insufficient granularity of access control in Active Directory Federation Services (AD FS) allows an authorized attacker to elevate privileges locally.
KEV Jul 14, 2026 -
High 7.8
Microsoft Exchange Server Elevation of Privilege Vulnerability
Insufficient granularity of access control in Microsoft Exchange Server allows an authorized attacker to elevate privileges locally.
-
High 7.8
Windows StateRepository API Server file Elevation of Privilege Vulnerability
Insufficient granularity of access control in Windows StateRepository API allows an authorized attacker to elevate privileges locally.
-
High 7.1
Insufficient granularity of access control in ASP (AMD Secure Processor) may allow an attacker with an untrusted user s…
-
High 7.3
Improper isolation of shared resources within the CPU operation cache on Zen 2-based products could allow an attacker t…
-
High 8.6
Improper Input Validation in the AMD RAID driver could allow an attacker to point to an arbitrary memory location poten…
-
High 8.8
Microsoft Office Click-To-Run Elevation of Privilege Vulnerability
Use after free in Microsoft Office allows an authorized attacker to elevate privileges locally.
-
High 8.8
Microsoft SharePoint Server Remote Code Execution Vulnerability
Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.
-
High 7.1
OpenClaw < 2026.4.20 - Gateway Config Mutation Guard Bypass via Agent Tool Access
OpenClaw before 2026.4.20 contains a guard bypass vulnerability in the agent-facing gateway config.patch and config.apply endpoints that fails to protect operator-trusted settings including sandbox policy, plugin enablement, gateway auth/TLS, hook routing, MC…
-
High 7.5
Spring Cloud Config has an Authorization Bypass Through User-Controlled Key
When using Google Secrets Manager as a backend for the Spring Cloud Config server a client can craft a request to the config server potentially exposing secrets from unintended GCP projects. Spring Cloud Config 3.1.x: affected from 3.1.0 through 3.1.13 (inclu…
-
High 8.2
Kata Containers: CopyFile Policy Subversion via Symlinks
Kata Containers is an open source project focusing on a standard implementation of lightweight Virtual Machines (VMs) that perform like containers. From v3.4.0 to v3.28.0, an oversight in the CopyFile policy (and perhaps the CopyFile handler) allows untrusted…
-
High 7.8
Microsoft Defender Elevation of Privilege Vulnerability
Insufficient granularity of access control in Microsoft Defender allows an authorized attacker to elevate privileges locally.
KEV Apr 22, 2026 -
High 8.2CVE-2026-39363 Public exploit
Vite Affected by Arbitrary File Read via Vite Dev Server WebSocket
Vite is a frontend tooling framework for JavaScript. From 6.0.0 to before 6.4.2, 7.3.2, and 8.0.5, if it is possible to connect to the Vite dev server’s WebSocket without an Origin header, an attacker can invoke fetchModule via the custom WebSocket event vite…
-
High 7.4
FastMCP OAuth Proxy token reuse across MCP servers
FastMCP is the standard framework for building MCP applications. Prior to version 2.14.2, the server does not properly respect the resource parameter submitted by the client in the authorization and token request. Instead of issuing the token explicitly for t…
-
High 7.9
Missing protection mechanism for alternate hardware interface in the Intel(R) Quick Assist Technology for some Intel(R)…
-
High 7.5
Insufficient Access Control in lunary-ai/lunary
In lunary-ai/lunary version 1.2.13, an insufficient granularity of access control vulnerability allows users to delete prompts created in other organizations through ID manipulation. The vulnerability stems from the application's failure to validate the owner…
-
High 7.5
Improper input validation in the system management mode (SMM) could allow a privileged attacker to overwrite arbitrary …
-
High 7.5
Insufficient granularity of access control in the OOB-MSM for some Intel(R) Xeon(R) 6 Scalable processors may allow a p…