CWE-1220 Insufficient Granularity of Access Control
baseThe product implements access controls via a policy or other feature with the intention to disable or restrict accesses (reads and/or writes) to assets in a system from untrusted agents. However, implemented access controls lack required granularity, which renders the control policy too broad because it allows accesses from unauthorized agents to the security-sensitive assets.
01
parent weaknesses
Broader classes this is a kind of.
02
child weaknesses
More specific entries beneath this one.
03
vulnerabilities (146)
Known CVEs related to this entry.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2026-56155US | —OT critical | KEV | ||
Insufficient granularity of access control in Active Directory Federation Services (AD FS) allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2026-33825US | —OT critical | KEV | ||
Insufficient granularity of access control in Microsoft Defender allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2025-31201US | —OT critical | KEV | ||
This issue was addressed by removing the vulnerable code. This issue is fixed in iOS 18.4.1 and iPadOS 18.4.1, macOS Sequoia 15.4.1, tvOS 18.4.1, visionOS 2.4.1. An attacker with a… | ||||
| CVE-2023-43040US | critical9.8 | Exploit | ||
IBM Spectrum Fusion HCI 2.5.2 through 2.7.2 could allow an attacker to perform unauthorized actions in RGW for Ceph due to improper bucket access. IBM X-Force ID: 266807. | ||||
| CVE-2024-42365US | high8.8 | Exploit | ||
Asterisk is an open source private branch exchange (PBX) and telephony toolkit. Prior to asterisk versions 18.24.2, 20.9.2, and 21.4.2 and certified-asterisk versions 18.9-cert11 a… | ||||
| CVE-2026-39363US | high7.5OT elevated | Exploit | ||
Vite is a frontend tooling framework for JavaScript. From 6.0.0 to before 6.4.2, 7.3.2, and 8.0.5, if it is possible to connect to the Vite dev server’s WebSocket without an Origin… | ||||
| CVE-2026-78122US | high7.4 | Exploit | ||
docker-socket-proxy fails to properly gate read endpoints in the /containers Docker API namespace when the CONTAINERS environment variable is set. Attackers can use GET requests to… | ||||
| CVE-2021-31384US | critical10.0OT elevated | — | ||
Due to a Missing Authorization weakness and Insufficient Granularity of Access Control in a specific device configuration, a vulnerability exists in Juniper Networks Junos OS on SR… | ||||
| CVE-2023-45866US | medium6.3 | Exploit | ||
Bluetooth HID Hosts in BlueZ may permit an unauthenticated Peripheral role HID Device to initiate and establish an encrypted connection, and accept HID keyboard reports, potentiall… | ||||
| CVE-2025-8053US | critical9.1 | — | ||
Insufficient Granularity of Access Control vulnerability in opentext Flipper allows Exploiting Incorrectly Configured Access Control Security Levels. The vulnerability could allow… | ||||
| CVE-2026-77480US | high8.8 | — | ||
Insufficient granularity of access control in SQL Server allows an authorized attacker to elevate privileges over a network. | ||||
| CVE-2026-66814US | high8.8 | — | ||
Insufficient granularity of access control in SQL Server allows an authorized attacker to elevate privileges over a network. | ||||
| CVE-2026-50502US | high8.8 | — | ||
Insufficient granularity of access control in Windows Event Logging Service allows an authorized attacker to execute code over a network. | ||||
| CVE-2025-8049US | high8.8 | — | ||
Insufficient Granularity of Access Control vulnerability in opentext Flipper allows Exploiting Incorrectly Configured Access Control Security Levels. The vulnerability could allow… | ||||
| CVE-2022-2475US | high8.8 | — | ||
Haas Controller version 100.20.000.1110 has insufficient granularity of access control when using the "Ethernet Q Commands" service. Any user is able to write macros into registers… | ||||
| CVE-2022-36110US | high8.8 | — | ||
Netmaker makes networks with WireGuard. Prior to version 0.15.1, Improper Authorization functions lead to non-privileged users running privileged API calls. If someone adds users t… | ||||
| CVE-2022-1025US | high8.8OT elevated | — | ||
All unpatched versions of Argo CD starting with v1.0.0 are vulnerable to an improper access control bug, allowing a malicious user to potentially escalate their privileges to admin… | ||||
| CVE-2022-24768US | high8.8OT elevated | — | ||
Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. All unpatched versions of Argo CD starting with 1.0.0 are vulnerable to an improper access control bug, al… | ||||
| CVE-2026-41326US | high8.2 | — | ||
Kata Containers is an open source project focusing on a standard implementation of lightweight Virtual Machines (VMs) that perform like containers. From v3.4.0 to v3.28.0, an overs… | ||||
| CVE-2024-43604US | high8.0 | — | ||
Outlook for Android Elevation of Privilege Vulnerability | ||||
04
attack patterns (2)
CAPEC attack patterns that exploit this.
05
source
Where this definition is published.
MITREUS
scry
Weaknesses like this turn up in real, exploitable exposures. See what is exposed on your perimeter with a free passive scan.
Free scan