CWE-1220 Insufficient Granularity of Access Control
baseThe product implements access controls via a policy or other feature with the intention to disable or restrict accesses (reads and/or writes) to assets in a system from untrusted agents. However, implemented access controls lack required granularity, which renders the control policy too broad because it allows accesses from unauthorized agents to the security-sensitive assets.
01
übergeordnete Schwächen
Übergeordnete Klassen, zu denen dies gehört.
02
untergeordnete Schwächen
Spezifischere Einträge unterhalb dieses.
03
Schwachstellen (146)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2026-56155US | —OT kritisch | KEV | ||
Insufficient granularity of access control in Active Directory Federation Services (AD FS) allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2026-33825US | —OT kritisch | KEV | ||
Insufficient granularity of access control in Microsoft Defender allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2025-31201US | —OT kritisch | KEV | ||
This issue was addressed by removing the vulnerable code. This issue is fixed in iOS 18.4.1 and iPadOS 18.4.1, macOS Sequoia 15.4.1, tvOS 18.4.1, visionOS 2.4.1. An attacker with a… | ||||
| CVE-2023-43040US | critical9.8 | Exploit | ||
IBM Spectrum Fusion HCI 2.5.2 through 2.7.2 could allow an attacker to perform unauthorized actions in RGW for Ceph due to improper bucket access. IBM X-Force ID: 266807. | ||||
| CVE-2024-42365US | high8.8 | Exploit | ||
Asterisk is an open source private branch exchange (PBX) and telephony toolkit. Prior to asterisk versions 18.24.2, 20.9.2, and 21.4.2 and certified-asterisk versions 18.9-cert11 a… | ||||
| CVE-2026-39363US | high7.5OT erhöht | Exploit | ||
Vite is a frontend tooling framework for JavaScript. From 6.0.0 to before 6.4.2, 7.3.2, and 8.0.5, if it is possible to connect to the Vite dev server’s WebSocket without an Origin… | ||||
| CVE-2026-78122US | high7.4 | Exploit | ||
docker-socket-proxy fails to properly gate read endpoints in the /containers Docker API namespace when the CONTAINERS environment variable is set. Attackers can use GET requests to… | ||||
| CVE-2021-31384US | critical10.0OT erhöht | — | ||
Due to a Missing Authorization weakness and Insufficient Granularity of Access Control in a specific device configuration, a vulnerability exists in Juniper Networks Junos OS on SR… | ||||
| CVE-2023-45866US | medium6.3 | Exploit | ||
Bluetooth HID Hosts in BlueZ may permit an unauthenticated Peripheral role HID Device to initiate and establish an encrypted connection, and accept HID keyboard reports, potentiall… | ||||
| CVE-2025-8053US | critical9.1 | — | ||
Insufficient Granularity of Access Control vulnerability in opentext Flipper allows Exploiting Incorrectly Configured Access Control Security Levels. The vulnerability could allow… | ||||
| CVE-2026-77480US | high8.8 | — | ||
Insufficient granularity of access control in SQL Server allows an authorized attacker to elevate privileges over a network. | ||||
| CVE-2026-66814US | high8.8 | — | ||
Insufficient granularity of access control in SQL Server allows an authorized attacker to elevate privileges over a network. | ||||
| CVE-2026-50502US | high8.8 | — | ||
Insufficient granularity of access control in Windows Event Logging Service allows an authorized attacker to execute code over a network. | ||||
| CVE-2025-8049US | high8.8 | — | ||
Insufficient Granularity of Access Control vulnerability in opentext Flipper allows Exploiting Incorrectly Configured Access Control Security Levels. The vulnerability could allow… | ||||
| CVE-2022-2475US | high8.8 | — | ||
Haas Controller version 100.20.000.1110 has insufficient granularity of access control when using the "Ethernet Q Commands" service. Any user is able to write macros into registers… | ||||
| CVE-2022-36110US | high8.8 | — | ||
Netmaker makes networks with WireGuard. Prior to version 0.15.1, Improper Authorization functions lead to non-privileged users running privileged API calls. If someone adds users t… | ||||
| CVE-2022-1025US | high8.8OT erhöht | — | ||
All unpatched versions of Argo CD starting with v1.0.0 are vulnerable to an improper access control bug, allowing a malicious user to potentially escalate their privileges to admin… | ||||
| CVE-2022-24768US | high8.8OT erhöht | — | ||
Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. All unpatched versions of Argo CD starting with 1.0.0 are vulnerable to an improper access control bug, al… | ||||
| CVE-2026-41326US | high8.2 | — | ||
Kata Containers is an open source project focusing on a standard implementation of lightweight Virtual Machines (VMs) that perform like containers. From v3.4.0 to v3.28.0, an overs… | ||||
| CVE-2024-43604US | high8.0 | — | ||
Outlook for Android Elevation of Privilege Vulnerability | ||||
04
Angriffsmuster (2)
CAPEC-Angriffsmuster, die dies ausnutzen.
05
Quelle
Wo diese Definition veröffentlicht ist.
MITREUS
scry
Schwächen wie diese tauchen in realen, ausnutzbaren Angriffsflächen auf. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan