CWE-1220
AllowedInsufficient Granularity of Access Control
Abstraction: Base · Status: Incomplete
The product implements access controls via a policy or other feature with the intention to disable or restrict accesses (reads and/or writes) to assets in a system from untrusted agents. However, implemented access controls lack required granularity, which renders the control policy too broad because it allows accesses from unauthorized agents to the security-sensitive assets.
206 vulnerabilities reference this CWE, most recent first.
GHSA-PRWG-9HMQ-GJ4J
Vulnerability from github – Published: 2023-04-22 03:30 – Updated: 2024-04-04 03:38NVIDIA ConnectX-5, ConnectX-6, and ConnectX6-DX contain a vulnerability in the NIC firmware, where an unprivileged user can exploit insufficient granularity of access control, which may lead to denial of service.
{
"affected": [],
"aliases": [
"CVE-2023-0205"
],
"database_specific": {
"cwe_ids": [
"CWE-1220"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-04-22T03:15:09Z",
"severity": "HIGH"
},
"details": "NVIDIA ConnectX-5, ConnectX-6, and ConnectX6-DX contain a vulnerability in the NIC firmware, where an unprivileged user can exploit insufficient granularity of access control, which may lead to denial of service.",
"id": "GHSA-prwg-9hmq-gj4j",
"modified": "2024-04-04T03:38:29Z",
"published": "2023-04-22T03:30:18Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-0205"
},
{
"type": "WEB",
"url": "https://nvidia.custhelp.com/app/answers/detail/a_id/5459"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:L",
"type": "CVSS_V3"
}
]
}
GHSA-PV5W-G537-V27F
Vulnerability from github – Published: 2024-03-15 15:30 – Updated: 2024-05-23 00:30An access-control flaw was found in the OpenStack Designate component where private configuration information including access keys to BIND were improperly made world readable. A malicious attacker with access to any container could exploit this flaw to access sensitive information.
{
"affected": [],
"aliases": [
"CVE-2023-6725"
],
"database_specific": {
"cwe_ids": [
"CWE-1220"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-03-15T13:15:06Z",
"severity": "MODERATE"
},
"details": "An access-control flaw was found in the OpenStack Designate component where private configuration information including access keys to BIND were improperly made world readable. A malicious attacker with access to any container could exploit this flaw to access sensitive information.",
"id": "GHSA-pv5w-g537-v27f",
"modified": "2024-05-23T00:30:37Z",
"published": "2024-03-15T15:30:42Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-6725"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2024:2736"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2024:2770"
},
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2023-6725"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2249273"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L",
"type": "CVSS_V3"
}
]
}
GHSA-PW2V-HVC7-4W3Q
Vulnerability from github – Published: 2025-02-13 00:33 – Updated: 2025-11-03 21:32Insufficient granularity of access control in UEFI firmware in some Intel(R) processors may allow a authenticated user to potentially enable denial of service via local access.
{
"affected": [],
"aliases": [
"CVE-2024-39279"
],
"database_specific": {
"cwe_ids": [
"CWE-1220"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-02-12T22:15:35Z",
"severity": "MODERATE"
},
"details": "Insufficient granularity of access control in UEFI firmware in some Intel(R) processors may allow a authenticated user to potentially enable denial of service via local access.",
"id": "GHSA-pw2v-hvc7-4w3q",
"modified": "2025-11-03T21:32:41Z",
"published": "2025-02-13T00:33:06Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-39279"
},
{
"type": "WEB",
"url": "https://intel.com/content/www/us/en/security-center/advisory/intel-sa-01139.html"
},
{
"type": "WEB",
"url": "https://lists.debian.org/debian-lts-announce/2025/03/msg00021.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-PXV9-WJF4-MR7M
Vulnerability from github – Published: 2024-03-15 00:30 – Updated: 2024-03-15 00:30Microsoft Edge (Chromium-based) Security Feature Bypass Vulnerability
{
"affected": [],
"aliases": [
"CVE-2024-26246"
],
"database_specific": {
"cwe_ids": [
"CWE-1220"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-03-14T23:15:46Z",
"severity": "LOW"
},
"details": "Microsoft Edge (Chromium-based) Security Feature Bypass Vulnerability",
"id": "GHSA-pxv9-wjf4-mr7m",
"modified": "2024-03-15T00:30:22Z",
"published": "2024-03-15T00:30:22Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-26246"
},
{
"type": "WEB",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-26246"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:P/AC:L/PR:H/UI:R/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-Q3GW-3M7F-273F
Vulnerability from github – Published: 2025-07-02 15:30 – Updated: 2025-07-02 15:30A missing double-check feature in the WebGUI for CLI deactivation in Infinera G42 version R6.1.3 allows an authenticated administrator to make other management interfaces unavailable via local and network interfaces. The CLI deactivation via the WebGUI does not only stop CLI interface but deactivates also Linux Shell, WebGUI and Physical Serial Console access. No confirmation is asked at deactivation time. Loosing access to these services device administrators are at risk of completely loosing device control.
{
"affected": [],
"aliases": [
"CVE-2025-27026"
],
"database_specific": {
"cwe_ids": [
"CWE-1220"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-07-02T14:15:23Z",
"severity": "MODERATE"
},
"details": "A missing double-check feature in the WebGUI for CLI deactivation in Infinera G42 \nversion R6.1.3 allows an authenticated administrator to make other \nmanagement interfaces unavailable via local and network interfaces. The CLI deactivation via the WebGUI does not only stop CLI interface but deactivates also Linux Shell, WebGUI and Physical Serial Console access. No \nconfirmation is asked at deactivation time. Loosing access to these services device administrators are at risk of completely loosing device control.",
"id": "GHSA-q3gw-3m7f-273f",
"modified": "2025-07-02T15:30:37Z",
"published": "2025-07-02T15:30:37Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-27026"
},
{
"type": "WEB",
"url": "https://euvd.enisa.europa.eu/vulnerability/CVE-2025-27026"
},
{
"type": "WEB",
"url": "https://www.cvcn.gov.it/cvcn/cve/CVE-2025-27026"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-Q4HH-VRVH-R4H7
Vulnerability from github – Published: 2025-04-16 21:30 – Updated: 2025-11-24 15:30This issue was addressed by removing the vulnerable code. This issue is fixed in tvOS 18.4.1, visionOS 2.4.1, iOS iOS 18.4.1 and iPadOS 18.4.1, macOS Sequoia 15.4.1. An attacker with arbitrary read and write capability may be able to bypass Pointer Authentication. Apple is aware of a report that this issue may have been exploited in an extremely sophisticated attack against specific targeted individuals on iOS.
{
"affected": [],
"aliases": [
"CVE-2025-31201"
],
"database_specific": {
"cwe_ids": [
"CWE-1220"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-04-16T19:15:54Z",
"severity": "MODERATE"
},
"details": "This issue was addressed by removing the vulnerable code. This issue is fixed in tvOS 18.4.1, visionOS 2.4.1, iOS iOS 18.4.1 and iPadOS 18.4.1, macOS Sequoia 15.4.1. An attacker with arbitrary read and write capability may be able to bypass Pointer Authentication. Apple is aware of a report that this issue may have been exploited in an extremely sophisticated attack against specific targeted individuals on iOS.",
"id": "GHSA-q4hh-vrvh-r4h7",
"modified": "2025-11-24T15:30:27Z",
"published": "2025-04-16T21:30:57Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-31201"
},
{
"type": "WEB",
"url": "https://github.com/cisagov/vulnrichment/issues/200"
},
{
"type": "WEB",
"url": "https://github.com/JGoyd/iOS-Attack-Chain-CVE-2025-31200-CVE-2025-31201/blob/main/Remote%20Crypto%20Attack%20Chain%20.md"
},
{
"type": "WEB",
"url": "https://support.apple.com/en-us/122282"
},
{
"type": "WEB",
"url": "https://support.apple.com/en-us/122400"
},
{
"type": "WEB",
"url": "https://support.apple.com/en-us/122401"
},
{
"type": "WEB",
"url": "https://support.apple.com/en-us/122402"
},
{
"type": "WEB",
"url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-31201"
},
{
"type": "WEB",
"url": "http://seclists.org/fulldisclosure/2025/Apr/26"
},
{
"type": "WEB",
"url": "http://seclists.org/fulldisclosure/2025/Jun/14"
},
{
"type": "WEB",
"url": "http://seclists.org/fulldisclosure/2025/Oct/0"
},
{
"type": "WEB",
"url": "http://seclists.org/fulldisclosure/2025/Oct/3"
},
{
"type": "WEB",
"url": "http://seclists.org/fulldisclosure/2025/Oct/4"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-Q737-5CW3-3G78
Vulnerability from github – Published: 2025-02-26 18:30 – Updated: 2025-02-26 18:30A vulnerability in the health monitoring diagnostics of Cisco Nexus 3000 Series Switches and Cisco Nexus 9000 Series Switches in standalone NX-OS mode could allow an unauthenticated, adjacent attacker to cause the device to reload unexpectedly, resulting in a denial of service (DoS) condition.
This vulnerability is due to the incorrect handling of specific Ethernet frames. An attacker could exploit this vulnerability by sending a sustained rate of crafted Ethernet frames to an affected device. A successful exploit could allow the attacker to cause the device to reload.
{
"affected": [],
"aliases": [
"CVE-2025-20111"
],
"database_specific": {
"cwe_ids": [
"CWE-1220"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-02-26T17:15:22Z",
"severity": "HIGH"
},
"details": "A vulnerability in the health monitoring diagnostics of Cisco Nexus 3000 Series Switches and Cisco Nexus 9000 Series Switches in standalone NX-OS mode could allow an unauthenticated, adjacent attacker to cause the device to reload unexpectedly, resulting in a denial of service (DoS) condition.\n\nThis vulnerability is due to the incorrect handling of specific Ethernet frames. An attacker could exploit this vulnerability by sending a sustained rate of crafted Ethernet frames to an affected device. A successful exploit could allow the attacker to cause the device to reload.",
"id": "GHSA-q737-5cw3-3g78",
"modified": "2025-02-26T18:30:39Z",
"published": "2025-02-26T18:30:39Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-20111"
},
{
"type": "WEB",
"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-n3kn9k-healthdos-eOqSWK4g"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-Q768-3M4H-QJ2J
Vulnerability from github – Published: 2025-05-09 18:30 – Updated: 2025-05-09 18:30An issue has been discovered in GitLab CE/EE affecting all versions from 12.0 before 17.9.8, 17.10 before 17.10.6, and 17.11 before 17.11.2. Under certain conditions users could bypass IP access restrictions and view sensitive information.
{
"affected": [],
"aliases": [
"CVE-2025-1278"
],
"database_specific": {
"cwe_ids": [
"CWE-1220"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-05-09T17:15:50Z",
"severity": "MODERATE"
},
"details": "An issue has been discovered in GitLab CE/EE affecting all versions from 12.0 before 17.9.8, 17.10 before 17.10.6, and 17.11 before 17.11.2. Under certain conditions users could bypass IP access restrictions and view sensitive information.",
"id": "GHSA-q768-3m4h-qj2j",
"modified": "2025-05-09T18:30:39Z",
"published": "2025-05-09T18:30:39Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-1278"
},
{
"type": "WEB",
"url": "https://hackerone.com/reports/2977149"
},
{
"type": "WEB",
"url": "https://gitlab.com/gitlab-org/gitlab/-/issues/519580"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-QFR4-PPJQ-9GR3
Vulnerability from github – Published: 2026-08-12 12:32 – Updated: 2026-08-12 18:31The Google Cloud Secret Manager secrets backend in Apache Airflow's Google provider never applied the team scope when resolving Connections and Variables: the caller's team_name was accepted by the backend but dropped at the internal call boundary, so every lookup resolved against the team-agnostic secret name. In a deployment running multi-team mode with this backend, a task or Dag belonging to one team resolved another team's Connection or Variable, obtaining its credentials in full. No unusual configuration is required beyond enabling multi-team mode and using this backend. Users are advised to upgrade to apache-airflow-providers-google 22.3.0 or later, which builds and applies the team-scoped secret name.
{
"affected": [],
"aliases": [
"CVE-2026-68868"
],
"database_specific": {
"cwe_ids": [
"CWE-1220"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-08-12T11:17:10Z",
"severity": "MODERATE"
},
"details": "The Google Cloud Secret Manager secrets backend in Apache Airflow\u0027s Google provider never applied the team scope when resolving Connections and Variables: the caller\u0027s `team_name` was accepted by the backend but dropped at the internal call boundary, so every lookup resolved against the team-agnostic secret name. In a deployment running multi-team mode with this backend, a task or Dag belonging to one team resolved another team\u0027s Connection or Variable, obtaining its credentials in full. No unusual configuration is required beyond enabling multi-team mode and using this backend. Users are advised to upgrade to apache-airflow-providers-google 22.3.0 or later, which builds and applies the team-scoped secret name.",
"id": "GHSA-qfr4-ppjq-9gr3",
"modified": "2026-08-12T18:31:16Z",
"published": "2026-08-12T12:32:54Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-68868"
},
{
"type": "WEB",
"url": "https://github.com/apache/airflow/pull/70869"
},
{
"type": "WEB",
"url": "https://lists.apache.org/thread/03h5y0fmqlh0yf055zlocxh591ozx69x"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2026/08/12/3"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-QHXP-2823-2PW9
Vulnerability from github – Published: 2026-07-14 18:32 – Updated: 2026-07-14 18:32Insufficient granularity of access control in Windows Event Logging Service allows an authorized attacker to execute code over a network.
{
"affected": [],
"aliases": [
"CVE-2026-50502"
],
"database_specific": {
"cwe_ids": [
"CWE-1220"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-07-14T18:17:57Z",
"severity": "HIGH"
},
"details": "Insufficient granularity of access control in Windows Event Logging Service allows an authorized attacker to execute code over a network.",
"id": "GHSA-qhxp-2823-2pw9",
"modified": "2026-07-14T18:32:28Z",
"published": "2026-07-14T18:32:28Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-50502"
},
{
"type": "WEB",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50502"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
Mitigation
- Access-control-policy protections must be reviewed for design inconsistency and common weaknesses.
- Access-control-policy definition and programming flow must be tested in pre-silicon, post-silicon testing.
CAPEC-1: Accessing Functionality Not Properly Constrained by ACLs
In applications, particularly web applications, access to functionality is mitigated by an authorization framework. This framework maps Access Control Lists (ACLs) to elements of the application's functionality; particularly URL's for web apps. In the case that the administrator failed to specify an ACL for a particular element, an attacker may be able to access it with impunity. An attacker with the ability to access functionality not properly constrained by ACLs can obtain sensitive information and possibly compromise the entire application. Such an attacker can access resources that must be available only to users at a higher privilege level, can access management sections of the application, or can run queries for data that they otherwise not supposed to.
CAPEC-180: Exploiting Incorrectly Configured Access Control Security Levels
An attacker exploits a weakness in the configuration of access controls and is able to bypass the intended protection that these measures guard against and thereby obtain unauthorized access to the system or network. Sensitive functionality should always be protected with access controls. However configuring all but the most trivial access control systems can be very complicated and there are many opportunities for mistakes. If an attacker can learn of incorrectly configured access security settings, they may be able to exploit this in an attack.