CWE-1220
AllowedInsufficient Granularity of Access Control
Abstraction: Base · Status: Incomplete
The product implements access controls via a policy or other feature with the intention to disable or restrict accesses (reads and/or writes) to assets in a system from untrusted agents. However, implemented access controls lack required granularity, which renders the control policy too broad because it allows accesses from unauthorized agents to the security-sensitive assets.
176 vulnerabilities reference this CWE, most recent first.
GHSA-HQWV-QHHM-QQ2G
Vulnerability from github – Published: 2023-06-14 06:30 – Updated: 2023-06-14 06:30Insufficient Granularity of Access Control in GitHub repository fossbilling/fossbilling prior to 0.5.0.
{
"affected": [],
"aliases": [
"CVE-2023-3227"
],
"database_specific": {
"cwe_ids": [
"CWE-1220"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-06-14T06:15:08Z",
"severity": "MODERATE"
},
"details": "Insufficient Granularity of Access Control in GitHub repository fossbilling/fossbilling prior to 0.5.0.",
"id": "GHSA-hqwv-qhhm-qq2g",
"modified": "2023-06-14T06:30:37Z",
"published": "2023-06-14T06:30:37Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-3227"
},
{
"type": "WEB",
"url": "https://github.com/fossbilling/fossbilling/commit/b65a75fcf70feaf547d414672f78d7cbe8a98e7e"
},
{
"type": "WEB",
"url": "https://huntr.dev/bounties/97ecf4b8-7eeb-4e39-917c-2660262ff9ba"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-HXVF-RH49-68GJ
Vulnerability from github – Published: 2026-07-14 18:32 – Updated: 2026-07-14 18:32Insufficient granularity of access control in Microsoft Exchange Server allows an authorized attacker to elevate privileges locally.
{
"affected": [],
"aliases": [
"CVE-2026-55006"
],
"database_specific": {
"cwe_ids": [
"CWE-1220"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-07-14T17:17:08Z",
"severity": "HIGH"
},
"details": "Insufficient granularity of access control in Microsoft Exchange Server allows an authorized attacker to elevate privileges locally.",
"id": "GHSA-hxvf-rh49-68gj",
"modified": "2026-07-14T18:32:09Z",
"published": "2026-07-14T18:32:09Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-55006"
},
{
"type": "WEB",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55006"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-JHPQ-G463-WV89
Vulnerability from github – Published: 2026-02-10 21:31 – Updated: 2026-02-10 21:31Insufficient Granularity of Access Control in SEV firmware could allow a privileged user with a malicious hypervisor to create a SEV-ES guest with an ASID in the range meant for SEV-SNP guests potentially resulting in a partial loss of confidentiality.
{
"affected": [],
"aliases": [
"CVE-2025-48517"
],
"database_specific": {
"cwe_ids": [
"CWE-1220"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-02-10T20:16:45Z",
"severity": "MODERATE"
},
"details": "Insufficient Granularity of Access Control in SEV firmware could allow a privileged user with a malicious hypervisor to create a SEV-ES guest with an ASID in the range meant for SEV-SNP guests potentially resulting in a partial loss of confidentiality.",
"id": "GHSA-jhpq-g463-wv89",
"modified": "2026-02-10T21:31:31Z",
"published": "2026-02-10T21:31:30Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-48517"
},
{
"type": "WEB",
"url": "https://www.amd.com/en/resources/product-security/bulletin/AMD-SB-3023.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-JJ68-CP4V-98QF
Vulnerability from github – Published: 2024-07-02 21:20 – Updated: 2024-07-05 21:27aimeos/ai-admin-graphql is the Aimeos GraphQL API admin interface. Starting in version 2022.04.1 and prior to versions 2022.10.10, 2023.10.6, and 2024.4.2, improper access control allows a editors to manage own services via GraphQL API which isn't allowed in the JQAdm front end. Versions 2022.10.10, 2023.10.6, and 2024.4.2 contain a patch for the issue.
{
"affected": [
{
"package": {
"ecosystem": "Packagist",
"name": "aimeos/ai-admin-graphql"
},
"ranges": [
{
"events": [
{
"introduced": "2022.04.1"
},
{
"fixed": "2022.10.10"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Packagist",
"name": "aimeos/ai-admin-graphql"
},
"ranges": [
{
"events": [
{
"introduced": "2023.04.1"
},
{
"fixed": "2023.10.6"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Packagist",
"name": "aimeos/ai-admin-graphql"
},
"ranges": [
{
"events": [
{
"introduced": "2024.04.1"
},
{
"fixed": "2024.04.2"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"2024.04.1"
]
}
],
"aliases": [
"CVE-2024-39324"
],
"database_specific": {
"cwe_ids": [
"CWE-1220",
"CWE-863"
],
"github_reviewed": true,
"github_reviewed_at": "2024-07-02T21:20:55Z",
"nvd_published_at": "2024-07-02T21:15:11Z",
"severity": "LOW"
},
"details": "aimeos/ai-admin-graphql is the Aimeos GraphQL API admin interface. Starting in version 2022.04.1 and prior to versions 2022.10.10, 2023.10.6, and 2024.4.2, improper access control allows a editors to manage own services via GraphQL API which isn\u0027t allowed in the JQAdm front end. Versions 2022.10.10, 2023.10.6, and 2024.4.2 contain a patch for the issue.\n",
"id": "GHSA-jj68-cp4v-98qf",
"modified": "2024-07-05T21:27:07Z",
"published": "2024-07-02T21:20:55Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/aimeos/ai-admin-graphql/security/advisories/GHSA-jj68-cp4v-98qf"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-39324"
},
{
"type": "WEB",
"url": "https://github.com/aimeos/ai-admin-graphql/commit/4eabc2b973509ffa5924e7f88c8f87ee96e93b38"
},
{
"type": "WEB",
"url": "https://github.com/aimeos/ai-admin-graphql/commit/687059d7eb2e1d55a09ed72dad3814f35edad038"
},
{
"type": "WEB",
"url": "https://github.com/aimeos/ai-admin-graphql/commit/a839a5adf16fee4221d444b7d2f5140d8cabf0ac"
},
{
"type": "WEB",
"url": "https://github.com/aimeos/ai-admin-graphql/commit/acbb044620f4ff8e8d78a775cd205ec47cf119b3"
},
{
"type": "PACKAGE",
"url": "https://github.com/aimeos/ai-admin-graphql"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:L",
"type": "CVSS_V3"
}
],
"summary": "aimeos/ai-admin-graphql improper access control vulnerability allows editors to manage own services"
}
GHSA-JQQW-X8W5-V4HH
Vulnerability from github – Published: 2025-05-22 15:34 – Updated: 2025-05-22 15:34An issue has been discovered in GitLab CE/EE affecting all versions from 18.0 before 18.0.1. In certain circumstances, a user with limited permissions could access Job Data via a crafted GraphQL query.
{
"affected": [],
"aliases": [
"CVE-2025-1110"
],
"database_specific": {
"cwe_ids": [
"CWE-1220",
"CWE-863"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-05-22T14:16:02Z",
"severity": "LOW"
},
"details": "An issue has been discovered in GitLab CE/EE affecting all versions from 18.0 before 18.0.1. In certain circumstances, a user with limited permissions could access Job Data via a crafted GraphQL query.",
"id": "GHSA-jqqw-x8w5-v4hh",
"modified": "2025-05-22T15:34:50Z",
"published": "2025-05-22T15:34:50Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-1110"
},
{
"type": "WEB",
"url": "https://hackerone.com/reports/2972576"
},
{
"type": "WEB",
"url": "https://gitlab.com/gitlab-org/gitlab/-/issues/517693"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-MMPV-V7Q9-GJ2H
Vulnerability from github – Published: 2022-03-31 00:00 – Updated: 2022-04-05 00:00Accounting User Can Download Patient Reports in openemr in GitHub repository openemr/openemr prior to 6.1.0.
{
"affected": [],
"aliases": [
"CVE-2022-1177"
],
"database_specific": {
"cwe_ids": [
"CWE-1220",
"CWE-863"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-03-30T11:15:00Z",
"severity": "MODERATE"
},
"details": "Accounting User Can Download Patient Reports in openemr in GitHub repository openemr/openemr prior to 6.1.0.",
"id": "GHSA-mmpv-v7q9-gj2h",
"modified": "2022-04-05T00:00:36Z",
"published": "2022-03-31T00:00:23Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-1177"
},
{
"type": "WEB",
"url": "https://github.com/openemr/openemr/commit/a2e918abcf15f9fc1f7cb4a1f2b09ff019021175"
},
{
"type": "WEB",
"url": "https://huntr.dev/bounties/0bb2979b-9643-4cdf-ab58-4354976b481b"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-MX9C-Q7M4-FM97
Vulnerability from github – Published: 2026-04-16 00:54 – Updated: 2026-06-30 03:36A flaw was found in ArgoCD Image Updater. This vulnerability allows an attacker, with permissions to create or modify an ImageUpdater resource in a multi-tenant environment, to bypass namespace boundaries. By exploiting insufficient validation, the attacker can trigger unauthorized image updates on applications managed by other tenants. This leads to cross-namespace privilege escalation, impacting application integrity through unauthorized application updates.
{
"affected": [],
"aliases": [
"CVE-2026-6388"
],
"database_specific": {
"cwe_ids": [
"CWE-1220"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-04-15T22:17:22Z",
"severity": "CRITICAL"
},
"details": "A flaw was found in ArgoCD Image Updater. This vulnerability allows an attacker, with permissions to create or modify an ImageUpdater resource in a multi-tenant environment, to bypass namespace boundaries. By exploiting insufficient validation, the attacker can trigger unauthorized image updates on applications managed by other tenants. This leads to cross-namespace privilege escalation, impacting application integrity through unauthorized application updates.",
"id": "GHSA-mx9c-q7m4-fm97",
"modified": "2026-06-30T03:36:17Z",
"published": "2026-04-16T00:54:04Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-6388"
},
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2026-6388"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2458766"
},
{
"type": "WEB",
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-6388.json"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:L",
"type": "CVSS_V3"
}
]
}
GHSA-P3QW-P56V-PXCR
Vulnerability from github – Published: 2024-10-08 18:33 – Updated: 2024-10-08 18:33Outlook for Android Elevation of Privilege Vulnerability
{
"affected": [],
"aliases": [
"CVE-2024-43604"
],
"database_specific": {
"cwe_ids": [
"CWE-1220"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-10-08T18:15:28Z",
"severity": "MODERATE"
},
"details": "Outlook for Android Elevation of Privilege Vulnerability",
"id": "GHSA-p3qw-p56v-pxcr",
"modified": "2024-10-08T18:33:17Z",
"published": "2024-10-08T18:33:17Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-43604"
},
{
"type": "WEB",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-43604"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-P3V3-229H-MC63
Vulnerability from github – Published: 2026-04-24 15:32 – Updated: 2026-05-05 18:11The authenticated /ui/dags endpoint did not enforce per-DAG access control on embedded Human-in-the-Loop (HITL) and TaskInstance records: a logged-in Airflow user with read access to at least one DAG could retrieve HITL prompts (including their request parameters) and full TaskInstance details for DAGs outside their authorized scope. Because HITL prompts and TaskInstance fields routinely carry operator parameters and free-form context attached to a task, the leak widens visibility of DAG-run data beyond the intended per-DAG RBAC boundary for every authenticated user.
Users are recommended to upgrade to version 3.2.1 , which fixes this issue.
{
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "apache-airflow"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "3.2.1rc1"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-38743"
],
"database_specific": {
"cwe_ids": [
"CWE-1220"
],
"github_reviewed": true,
"github_reviewed_at": "2026-05-05T18:11:27Z",
"nvd_published_at": "2026-04-24T13:16:21Z",
"severity": "MODERATE"
},
"details": "The authenticated /ui/dags\u00a0endpoint did not enforce per-DAG access control on embedded Human-in-the-Loop (HITL) and TaskInstance records: a logged-in Airflow user with read access to at least one DAG could retrieve HITL prompts (including their request parameters) and full TaskInstance details for DAGs outside their authorized scope. Because HITL prompts and TaskInstance fields routinely carry operator parameters and free-form context attached to a task, the leak widens visibility of DAG-run data beyond the intended per-DAG RBAC boundary for every authenticated user.\n\nUsers are recommended to upgrade to version 3.2.1 , which fixes this issue.",
"id": "GHSA-p3v3-229h-mc63",
"modified": "2026-05-05T18:11:27Z",
"published": "2026-04-24T15:32:32Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-38743"
},
{
"type": "WEB",
"url": "https://github.com/apache/airflow/pull/64822"
},
{
"type": "WEB",
"url": "https://github.com/apache/airflow/commit/fed4921098d51fd3ec17b7f5cff80f6c36fd05e2"
},
{
"type": "PACKAGE",
"url": "https://github.com/apache/airflow"
},
{
"type": "WEB",
"url": "https://lists.apache.org/thread/sk2wj0x48o8qb4p7c47gvnhjbm0mg396"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2026/04/24/3"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
],
"summary": "Apache Airflow\u0027s authenticated /ui/dags\u00a0endpoint did not enforce per-DAG access control on embedded Human-in-the-Loop (HITL) and TaskInstance record"
}
GHSA-P436-QCH3-9M59
Vulnerability from github – Published: 2026-07-14 18:32 – Updated: 2026-07-14 21:31Insufficient granularity of access control in Active Directory Federation Services (AD FS) allows an authorized attacker to elevate privileges locally.
{
"affected": [],
"aliases": [
"CVE-2026-56155"
],
"database_specific": {
"cwe_ids": [
"CWE-1220"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-07-14T17:17:09Z",
"severity": "HIGH"
},
"details": "Insufficient granularity of access control in Active Directory Federation Services (AD FS) allows an authorized attacker to elevate privileges locally.",
"id": "GHSA-p436-qch3-9m59",
"modified": "2026-07-14T21:31:50Z",
"published": "2026-07-14T18:32:10Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-56155"
},
{
"type": "WEB",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-56155"
},
{
"type": "WEB",
"url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-56155"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
Mitigation
- Access-control-policy protections must be reviewed for design inconsistency and common weaknesses.
- Access-control-policy definition and programming flow must be tested in pre-silicon, post-silicon testing.
CAPEC-1: Accessing Functionality Not Properly Constrained by ACLs
In applications, particularly web applications, access to functionality is mitigated by an authorization framework. This framework maps Access Control Lists (ACLs) to elements of the application's functionality; particularly URL's for web apps. In the case that the administrator failed to specify an ACL for a particular element, an attacker may be able to access it with impunity. An attacker with the ability to access functionality not properly constrained by ACLs can obtain sensitive information and possibly compromise the entire application. Such an attacker can access resources that must be available only to users at a higher privilege level, can access management sections of the application, or can run queries for data that they otherwise not supposed to.
CAPEC-180: Exploiting Incorrectly Configured Access Control Security Levels
An attacker exploits a weakness in the configuration of access controls and is able to bypass the intended protection that these measures guard against and thereby obtain unauthorized access to the system or network. Sensitive functionality should always be protected with access controls. However configuring all but the most trivial access control systems can be very complicated and there are many opportunities for mistakes. If an attacker can learn of incorrectly configured access security settings, they may be able to exploit this in an attack.