CWE-1220 · Access Control
Insufficient Granularity of Access Control
122CVEs
SortMost likely exploited
122 CVEs with CWE-1220 as their weakness
| CVE · most likely exploited | CVSS | EPSS | Published |
|---|---|---|---|
| CVE-2025-31201In CISA KEVExploitedThis issue was addressed by removing the vulnerable code. This issue is fixed in iOS 18.4.1 and iPadOS 18.4.1, macOS Sequoia 15.4.1, tvOS 18.4.1, visionOS 2.4.1. An attacker with…Apple · iOS and iPadOS · CVSS 9.8 · 2025-04-16 | 9.8 | 14% | 2025-04-16 |
| CVE-2026-33825In CISA KEVExploitedMicrosoft Defender Elevation of Privilege VulnerabilityMicrosoft · Microsoft Defender Antimalware Platform · CVSS 7.8 · 2026-04-14 | 7.8 | 6.9% | 2026-04-14 |
| CVE-2026-56155In CISA KEVExploitedActive Directory Federation Services Elevation of Privilege VulnerabilityMicrosoft · Windows 10 Version 1607 · CVSS 7.8 · 2026-07-14 | 7.8 | 0.3% | 2026-07-14 |
| CVE-2023-43040IBM Spectrum Fusion HCI improper access controlIBM · Spectrum Fusion HCI · CVSS 6.5 · 2024-05-13 | 6.5 | 3.1% | 2024-05-13 |
| CVE-2025-4404Freeipa: idm: privilege escalation from host to domain admin in freeipaRedhat · freeipa · CVSS 9.1 · 2025-06-17 | 9.1 | 2.0% | 2025-06-17 |
| CVE-2023-33127.NET and Visual Studio Elevation of Privilege VulnerabilityMicrosoft · .NET 6.0 · CVSS 8.1 · 2023-07-11 | 8.1 | 1.9% | 2023-07-11 |
| CVE-2025-3648Data Inference in Now Platform via Conditional ACLsServiceNow · Now Platform · CVSS 8.2 · 2025-07-08 | 8.2 | 1.7% | 2025-07-08 |
| CVE-2022-1025All unpatched versions of Argo CD starting with v1.0.0 are vulnerable to an improper access control bug, allowing a malicious user to potentially escalate their privileges to admi…Argoproj · ArgoCD · 2022-07-12 | – | 1.3% | 2022-07-12 |
| CVE-2024-43604Outlook for Android Elevation of Privilege VulnerabilityMicrosoft · Microsoft Outlook for Android · CVSS 5.7 · 2024-10-08 | 5.7 | 1.2% | 2024-10-08 |
| CVE-2023-39418Postgresql: merge fails to enforce update or select row security policiesRed Hat · Red Hat Enterprise Linux 8 · CVSS 3.1 · 2023-08-11 | 3.1 | 1.1% | 2023-08-11 |
| CVE-2024-8927cgi.force_redirect configuration is bypassable due to the environment variable collisionPHP Group · PHP · CVSS 7.5 · 2024-10-08 | 7.5 | 1.1% | 2024-10-08 |
| CVE-2026-40365Microsoft SharePoint Server Remote Code Execution VulnerabilityMicrosoft · Microsoft SharePoint Enterprise Server 2016 · CVSS 8.8 · 2026-05-12 | 8.8 | 1.0% | 2026-05-12 |
| CVE-2022-1461Non Privilege User can Enable or Disable Registered in openemr/openemropenemr · openemr/openemr · CVSS 8.1 · 2022-04-25 | 8.1 | 0.9% | 2022-04-25 |
| CVE-2022-36110Netmaker vulnerable to Insufficient Granularity of Access Controlgravitl · netmaker · CVSS 8.8 · 2022-09-09 | 8.8 | 0.9% | 2022-09-09 |
| CVE-2022-1177Accounting User Can Download Patient Reports in openemr in openemr/openemropenemr · openemr/openemr · CVSS 6.5 · 2022-03-30 | 6.5 | 0.9% | 2022-03-30 |
| CVE-2026-77480SQL Server Elevation of Privilege VulnerabilityMicrosoft · Microsoft SQL Server 2017 (CU 31) · CVSS 8.8 · 2026-09-08 | 8.8 | 0.8% | 2026-09-08 |
| CVE-2026-66814Microsoft SQL Server Elevation of Privilege VulnerabilityMicrosoft · Microsoft SQL Server 2017 (CU 31) · CVSS 8.8 · 2026-09-08 | 8.8 | 0.8% | 2026-09-08 |
| CVE-2023-27591Unauthenticated Miniflux user can bypass allowed networks check to obtain Prometheus metricsminiflux · v2 · CVSS 7.5 · 2023-03-17 | 7.5 | 0.8% | 2023-03-17 |
| CVE-2026-77777Improper access control vulnerabilityZohocorp · ManageEngine Key Manager Plus · CVSS 7.1 · 2026-11-03 | 7.1 | 0.7% | 2026-11-03 |
| CVE-2022-2475Haas Controller version 100.20.000.1110 has insufficient granularity of access control when using the "Ethernet Q Commands" service. Any user is able to write macros into register…Haas · Haas CNC Controller · CVSS 9.8 · 2022-10-28 | 9.8 | 0.7% | 2022-10-28 |
| CVE-2022-4801Insufficient Granularity of Access Control in usememos/memosusememos · usememos/memos · CVSS 8.2 · 2022-12-28 | 8.2 | 0.7% | 2022-12-28 |
| CVE-2026-50502Windows Event Logging Service Remote Code Execution VulnerabilityMicrosoft · Windows 10 Version 1607 · CVSS 8 · 2026-07-14 | 8.0 | 0.7% | 2026-07-14 |
| CVE-2024-29200API returns timesheet entries a user should not be authorized to viewkimai · kimai · CVSS 6.8 · 2024-03-28 | 6.8 | 0.6% | 2024-03-28 |
| CVE-2024-26246Microsoft Edge (Chromium-based) Security Feature Bypass VulnerabilityMicrosoft · Microsoft Edge for Android · CVSS 3.9 · 2024-03-14 | 3.9 | 0.6% | 2024-03-14 |
| CVE-2026-68868Apache Airflow Google provider: google Secret Manager backend: team scope is never applied, exposing every team's Connections and VariablesApache Software Foundation · Apache Airflow Google provider · CVSS 6.5 · 2026-08-12 | 6.5 | 0.6% | 2026-08-12 |
| CVE-2023-4456Openshift-logging: lokistack authorisation is cached too broadlyRed Hat · RHOL-5.5-RHEL-8 · CVSS 5.7 · 2023-08-21 | 5.7 | 0.6% | 2023-08-21 |
| CVE-2025-7493Freeipa: idm: privilege escalation from host to domain admin in freeipaRed Hat · Red Hat Enterprise Linux 10 · CVSS 9.1 · 2025-09-30 | 9.1 | 0.6% | 2025-09-30 |
| CVE-2022-4813Insufficient Granularity of Access Control in usememos/memosusememos · usememos/memos · CVSS 8.6 · 2022-12-28 | 8.6 | 0.6% | 2022-12-28 |
| CVE-2025-29987Dell PowerProtect Data Domain with Data Domain Operating System (DD OS) versions prior to 8.3.0.15 contain an Insufficient Granularity of Access Control vulnerability. An authenti…Dell · DD OS 8.3 · CVSS 8.8 · 2025-04-03 | 8.8 | 0.5% | 2025-04-03 |
| CVE-2026-77779Improper access control vulnerabilityZohocorp · ManageEngine Key Manager Plus · CVSS 7.7 · 2026-11-04 | 7.7 | 0.5% | 2026-11-04 |
| CVE-2023-0205NVIDIA ConnectX-5, ConnectX-6, and ConnectX6-DX contain a vulnerability in the NIC firmware, where an unprivileged user can exploit insufficient granularity of access control, whi…NVIDIA · NVIDIA ConnectX Firmware · CVSS 5 · 2023-04-22 | 5.0 | 0.5% | 2023-04-22 |
| CVE-2023-0203NVIDIA ConnectX-5, ConnectX-6, and ConnectX6-DX contain a vulnerability in the NIC firmware, where an unprivileged user can exploit insufficient granularity of access control, whi…NVIDIA · NVIDIA ConnectX Firmware · CVSS 5 · 2023-04-22 | 5.0 | 0.5% | 2023-04-22 |
| CVE-2025-32703Visual Studio Information Disclosure VulnerabilityMicrosoft · Microsoft Visual Studio 2017 version 15.9 (includes 15.0 - 15.8) · CVSS 5.5 · 2025-05-13 | 5.5 | 0.5% | 2025-05-13 |
| CVE-2026-85316Apache Camel: Camel-Platform-HTTP Unintended Proxy Mode via Prefix Path MatchingApache Software Foundation · Apache Camel · CVSS 4.8 · 2026-10-19 | 4.8 | 0.5% | 2026-10-19 |
| CVE-2025-7001Insufficient Granularity of Access Control in GitLabGitLab · GitLab · CVSS 4.3 · 2025-07-24 | 4.3 | 0.4% | 2025-07-24 |
| CVE-2024-39323aimeos/ai-admin-graphql improper access control vulnerability allows an editor to modify admin accountaimeos · ai-admin-graphql · CVSS 7.1 · 2024-07-02 | 7.1 | 0.4% | 2024-07-02 |
| CVE-2025-4979Insufficient Granularity of Access Control in GitLabGitLab · GitLab · CVSS 4.9 · 2025-05-22 | 4.9 | 0.4% | 2025-05-22 |
| CVE-2024-2412Heimavista Rpage and Epage - Broken Access ControlHeimavista · Rpage · CVSS 5.3 · 2024-03-13 | 5.3 | 0.4% | 2024-03-13 |
| CVE-2024-5389Insufficient Access Control in lunary-ai/lunarylunary-ai · lunary-ai/lunary · CVSS 5.7 · 2024-06-09 | 5.7 | 0.4% | 2024-06-09 |
| CVE-2024-4147Insufficient Access Control in lunary-ai/lunarylunary-ai · lunary-ai/lunary · CVSS 7.5 · 2026-02-02 | 7.5 | 0.4% | 2026-02-02 |
| CVE-2025-11246Insufficient Granularity of Access Control in GitLabGitLab · GitLab · CVSS 5.4 · 2026-01-09 | 5.4 | 0.4% | 2026-01-09 |
| CVE-2024-39324aimeos/ai-admin-graphql improper access control vulnerability allows editors to manage own servicesaimeos · ai-admin-graphql · CVSS 3.8 · 2024-07-02 | 3.8 | 0.4% | 2024-07-02 |
| CVE-2026-86338Ash field policies do not filter-nil forbidden calculations and aggregates, enabling an information-disclosure oracleash-project · ash · CVSS 6 · 2026-09-16 | 6.0 | 0.4% | 2026-09-16 |
| CVE-2026-78230AshAi aggregate tool can read field-policy-protected fieldsash-project · ash_ai · CVSS 6 · 2026-09-08 | 6.0 | 0.4% | 2026-09-08 |
| CVE-2026-78216AshLua eval read operations can read field-policy-protected fields via aggregatesash-project · ash_lua · CVSS 6 · 2026-09-08 | 6.0 | 0.4% | 2026-09-08 |
| CVE-2024-6867Information Disclosure in lunary-ai/lunarylunary-ai · lunary-ai/lunary · CVSS 4.3 · 2024-09-13 | 4.3 | 0.4% | 2024-09-13 |
| CVE-2026-16106Keycloak-services: keycloak-services: incorrect authorization in admin role-composite deletion allows delegated admin to remove privileged child rolesRed Hat · Red Hat build of Keycloak 26.6 · CVSS 4.9 · 2026-07-17 | 4.9 | 0.4% | 2026-07-17 |
| CVE-2024-13256Email Contact - Moderately critical - Access bypass - SA-CONTRIB-2024-020Drupal · Email Contact · CVSS 7.5 · 2025-01-09 | 7.5 | 0.4% | 2025-01-09 |
| CVE-2023-3227Insufficient Granularity of Access Control in fossbilling/fossbillingfossbilling · fossbilling/fossbilling · CVSS 5.4 · 2023-06-14 | 5.4 | 0.4% | 2023-06-14 |
| CVE-2026-77778Improper access control vulnerabilityZohocorp · ManageEngine Key Manager Plus · CVSS 7.1 · 2026-11-03 | 7.1 | 0.4% | 2026-11-03 |
EPSS is the probability of exploitation in the next 30 days (FIRST). Data as of 2026-11-14.