Insufficient Granularity of Access Control
CWE-1220
The product implements access controls via a policy or other feature with the intention to disable or restrict accesses (reads and/or writes) to assets in a system from untrusted agents. However, implemented access controls lack the required granularity
We track 53 vulnerabilities of this type. 100% are rated high or critical, and the average CVSS score is 8.1. 3 have been exploited in real attacks.
How this weakness is prevented
- Architecture and Design Implementation Testing: Access-control-policy protections must be reviewed for design inconsistency and common weaknesses. Access-control-policy definition and programming flow must be tested in pre-silicon, post-silicon testing.
Latest Insufficient Granularity of Access Control vulnerabilities
- 7.5 High severity
PHP: Insufficient Granularity of Access Control
In PHP versions 8.1.* before 8.1.30, 8.2.* before 8.2.24, 8.3.* before 8.3.12, HTTP_REDIRECT_STATUS variable is used to check whether or not CGI binary is being run by the HTTP server. However, in certain scenarios, the content of this variable can be controll
- 8.8 High severity
asterisk: Privilege Defined With Unsafe Actions
Asterisk is an open source private branch exchange (PBX) and telephony toolkit. Prior to asterisk versions 18.24.2, 20.9.2, and 21.4.2 and certified-asterisk versions 18.9-cert11 and 20.7-cert2, an AMI user with `write=originate` may change all configuration f
- 7.1 High severity
ai-admin-graphql: Incorrect Authorization
aimeos/ai-admin-graphql is the Aimeos GraphQL API admin interface. Starting in version 2022.04.01 and prior to versions 2022.10.10, 2023.10.6, and 2024.04.6, an improper access control vulnerability allows an editor to modify and take over an admin account in
- 8.1 High severity
lunary-ai/lunary: Insufficient Granularity of Access Control
In lunary-ai/lunary version 1.2.13, an insufficient granularity of access control vulnerability allows users to create, update, get, and delete prompt variations for datasets not owned by their organization. This issue arises due to the application not properl
- 7.8 High severity
Intel(R) Power Gadget software for Windows: Improper Access Control
Improper access control in Intel(R) Power Gadget software for Windows all versions may allow an authenticated user to potentially enable escalation of privilege via local access.
- 8.8 High severity
Intel(R) Power Gadget software for macOS: Improper Access Control
Improper access control in some Intel(R) Power Gadget software for macOS all versions may allow an authenticated user to potentially enable escalation of privilege via local access.
- 9.8 Critical severity
Spectrum Fusion HCI: Insufficient Granularity of Access Control
IBM Spectrum Fusion HCI 2.5.2 through 2.7.2 could allow an attacker to perform unauthorized actions in RGW for Ceph due to improper bucket access. IBM X-Force ID: 266807.
- 7.8 High severity
PowerProtect DD: Insufficient Granularity of Access Control
Dell PowerProtect DD, versions prior to 7.13.0.10, LTS 7.7.5.25, LTS 7.10.1.15, 6.2.1.110 contain an improper access control vulnerability. A local malicious user with low privileges could potentially exploit this vulnerability leading to escalation of privile
- 7.7 High severity
NVIDIA ConnectX Firmware: Insufficient Granularity of Access Control
NVIDIA ConnectX-5, ConnectX-6, and ConnectX6-DX contain a vulnerability in the NIC firmware, where an unprivileged user can exploit insufficient granularity of access control, which may lead to denial of service.
- 7.7 High severity
NVIDIA ConnectX Firmware: Insufficient Granularity of Access Control
NVIDIA ConnectX-5, ConnectX-6, and ConnectX6-DX contain a vulnerability in the NIC firmware, where an unprivileged user can exploit insufficient granularity of access control, which may lead to denial of service.
- 7.5 High severity
v2: Exposure of Sensitive Information to an Unauthorized Actor
Miniflux is a feed reader. Prior to version 2.0.43, an unauthenticated user can retrieve Prometheus metrics from a publicly reachable Miniflux instance where the `METRICS_COLLECTOR` configuration option is enabled and `METRICS_ALLOWED_NETWORKS` is set to `127.
- 8.8 High severity
Haas CNC Controller: Insufficient Granularity of Access Control
Haas Controller version 100.20.000.1110 has insufficient granularity of access control when using the "Ethernet Q Commands" service. Any user is able to write macros into registers outside of the authorized accessible range. This could allow a user to access p
- 8.8 High severity
netmaker: Improper Authorization
Netmaker makes networks with WireGuard. Prior to version 0.15.1, Improper Authorization functions lead to non-privileged users running privileged API calls. If someone adds users to the Netmaker platform who do not have admin privileges, they can use their aut