CWE-1220 Insufficient Granularity of Access Control
Description
The product implements access controls via a policy or other feature with the intention to disable or restrict accesses (reads and/or writes) to assets in a system from untrusted agents. However, implemented access controls lack required granularity, which renders the control policy too broad because it allows accesses from unauthorized agents to the security-sensitive assets.
Associated Reviewed Advisories
Vulnerabilities classified under CWE-1220 ordered by modification date.
| Advisory ID | NVD ID | Severity | PURLs | Summary | Last Modified |
|---|---|---|---|---|---|
| GHSA-8c7q-86fq-vvmh | CVE-2026-2651 | CRITICAL |
MLflow allows unauthorized access to multipart upload endpoints when the `--serve-artifacts` mode is enabled |
2026-10-06 | |
| GHSA-6g26-7cx5-mrrg | CVE-2026-9088 | LOW |
Keycloak: Information disclosure due to user profile permission bypass |
2026-07-16 | |
| GHSA-933f-rg6j-f46p | CVE-2026-37981 | MODERATE |
Keycloak Account Resources user lookup contains broken access control |
2026-06-30 | |
| GHSA-w7rc-q6cm-f5gm | CVE-2026-40690 | MODERATE |
Apache Airflow's asset dependency graph did not restrict nodes by the viewer's DAG read permissions |
2026-05-05 | |
| GHSA-p3v3-229h-mc63 | CVE-2026-38743 | MODERATE |
Apache Airflow's authenticated /ui/dags endpoint did not enforce per-DAG access control on embedded Human-in-the-Loop (HITL) and TaskInstance record |
2026-05-05 | |
| GHSA-7jm2-g593-4qrc | - | MODERATE |
OpenClaw: Agent gateway config mutations could change protected operator settings |
2026-04-25 | |
| GHSA-47wq-cj9q-wpmp | - | CRITICAL |
Paperclip: Cross-tenant agent API token minting via missing assertCompanyAccess on /api/agents/:id/keys |
2026-04-16 | |
| GHSA-9x88-4jg8-4vf7 | CVE-2024-2035 | MODERATE |
Improper authorization in zenml |
2025-10-15 | |
| GHSA-cj3c-5xpm-cx94 | CVE-2024-29200 | MODERATE | - |
Kimai API returns timesheet entries a user should not be authorized to view |
2025-10-13 |
| GHSA-9jmp-j63g-8x6m | CVE-2024-6867 | MODERATE |
Withdrawn Advisory: Lunary information disclosure vulnerability |
2025-06-20 | |
| GHSA-3qjf-qh38-x73v | CVE-2023-27591 | HIGH |
Unauthenticated Miniflux user can bypass allowed networks check to obtain Prometheus metrics |
2025-04-02 | |
| GHSA-3mwc-2cj7-gx8c | CVE-2024-5389 | MODERATE |
lunary-ai/lunary Access Control Vulnerability in Prompt Variation Management |
2024-11-25 | |
| GHSA-f4c9-cqv8-9v98 | CVE-2021-20066 | LOW |
Withdrawn Advisory: Insufficient Granularity of Access Control in JSDom |
2024-07-19 | |
| GHSA-jj68-cp4v-98qf | CVE-2024-39324 | LOW | - |
aimeos/ai-admin-graphql improper access control vulnerability allows editors to manage own services |
2024-07-05 |
| GHSA-vc7j-99jw-jrqm | CVE-2024-39323 | HIGH | - |
aimeos/ai-admin-graphql improper access control vulnerability allows an editor to modify admin account |
2024-07-05 |
| GHSA-485r-rp8v-998v | CVE-2023-33127 | HIGH |
Microsoft Security Advisory CVE-2023-33127: .NET Remote Code Execution Vulnerability |
2023-07-11 | |
| GHSA-ggf6-638m-vqmg | CVE-2022-36110 | HIGH |
Netmaker vulnerable to Insufficient Granularity of Access Control |
2023-06-27 | |
| GHSA-96jv-vj39-x4j6 | CVE-2022-1025 | HIGH |
Argo CD improper access control bug can allow malicious user to escalate privileges to admin level |
2023-06-27 | |
| GHSA-7qpw-2j9m-rw8c | CVE-2022-4813 | MODERATE |
usememos/memos has Insufficient Granularity of Access Control |
2023-01-10 | |
| GHSA-f83p-pg86-p922 | CVE-2022-4801 | MODERATE |
usememos/memos has Insufficient Granularity of Access Control |
2023-01-10 |