# CWE-1220.

Every Advisory and CVE whose sources give the weakness CWE-1220, newest first.

## Records, newest first (an older page)

- [Vite Vulnerable to Arbitrary File Read via Vite Dev Server WebSocket](https://agentprime.io/advisories/GHSA-p9ff-h696-f583.md)
  `GHSA-p9ff-h696-f583`, `CVE-2026-39363` · npm `vite`: affected `>=6.0.0, <6.4.2 || >=7.0.0, <7.3.2 || >=8.0.0, <8.0.5`, fixed in `6.4.2`, `7.3.2`, `8.0.5` · CVSS 8.2 High · Not analysed yet · Published 6 Apr 2026 · Tags: Information disclosure, Authentication bypass, CWE-1220
- [FastMCP OAuth Proxy token reuse across MCP servers](https://agentprime.io/advisories/GHSA-5h2m-4q8j-pqpj.md)
  `GHSA-5h2m-4q8j-pqpj`, `CVE-2025-69196`, `PYSEC-2026-2474` · PyPI `fastmcp`: affected `<2.14.2`, fixed in `2.14.2` · CVSS 7.4 High · Not analysed yet · Published 16 Mar 2026 · Tags: Broken access control, CWE-1220
- [Cisco Application Policy Infrastructure Controller Denial of Service Vulnerability](https://agentprime.io/advisories/CVE-2026-20107.md)
  `CVE-2026-20107` · CVE record: Cisco Cisco Application Policy Infrastructure Controller (APIC) · CVSS 5.5 Medium · Not analysed yet · Published 25 Feb 2026 · Tags: CWE-1220
- [Insufficient Granularity of Access Control in SEV firmware can allow a privileged attacker to create a SEV-ES Guest to attack SNP guest, potentially resulting in a loss of confidentiality.](https://agentprime.io/advisories/CVE-2025-48514.md)
  `CVE-2025-48514` · CVE record: AMD AMD EPYC™ 9004 Series Processors and 4 more · CVSS 4.0 Medium · Not analysed yet · Published 10 Feb 2026 · Tags: CWE-1220
- [Insufficient Granularity of Access Control in SEV firmware could allow a privileged user with a malicious hypervisor to create a SEV-ES guest with an ASID in the range meant for SEV-SNP guests potent…](https://agentprime.io/advisories/CVE-2025-48517.md)
  `CVE-2025-48517` · CVE record: AMD AMD EPYC™ 9005 Series Processors and 1 more · CVSS 4.6 Medium · Not analysed yet · Published 10 Feb 2026 · Tags: CWE-1220
- [Intel(R) Platforms: Missing protection mechanism for alternate hardware interface in the Intel(R) Quick…](https://agentprime.io/advisories/CVE-2025-35998.md)
  `CVE-2025-35998` · CVE record: Intel(R) Platforms · CVSS 7.0 High · Not analysed yet · Published 10 Feb 2026 · Tags: CWE-1220, CWE-1299
- [Privilege Elevation in Ercom Cryptobox administration console](https://agentprime.io/advisories/CVE-2026-0873.md)
  `CVE-2026-0873` · CVE record: Ercom Cryptobox · CVSS 4.8 Medium · Not analysed yet · Published 4 Feb 2026 · Tags: Cross-site scripting (XSS), CWE-1220
- [Insufficient Access Control in lunary-ai/lunary](https://agentprime.io/advisories/CVE-2024-4147.md)
  `CVE-2024-4147` · CVE record: lunary-ai lunary-ai/lunary · CVSS 7.5 High · Not analysed yet · Published 2 Feb 2026 · Tags: CWE-1220
- [Insufficient Granularity of Access Control in GitLab](https://agentprime.io/advisories/CVE-2025-11246.md)
  `CVE-2025-11246` · CVE record: GitLab GitLab · CVSS 5.4 Medium · Not analysed yet · Published 9 Jan 2026 · Tags: CWE-1220
- [Improper Access Control in Asseco Infomedica Plus](https://agentprime.io/advisories/CVE-2025-8306.md)
  `CVE-2025-8306` · CVE record: Asseco InfoMedica Plus · CVSS 5.1 Medium · Not analysed yet · Published 8 Jan 2026 · Tags: CWE-1220
- [A vulnerability in the web-based management interface of Cisco ISE could allow an authenticated, remote attacker to obtain sensitive information from an affected device.](https://agentprime.io/advisories/CVE-2025-20305.md)
  `CVE-2025-20305` · CVE record: Cisco Cisco Identity Services Engine Software · CVSS 4.3 Medium · Not analysed yet · Published 5 Nov 2025 · Tags: CWE-1220
- [Insufficient Access Control vulnerability has been discovered in OpenText Flipper.](https://agentprime.io/advisories/CVE-2025-8049.md)
  `CVE-2025-8049` · CVE record: opentext Flipper · CVSS 2.3 Low · Not analysed yet · Published 20 Oct 2025 · Tags: CWE-1220
- [Insufficient access control vulnerability has been discovered in Opentext Flipper.](https://agentprime.io/advisories/CVE-2025-8053.md)
  `CVE-2025-8053` · CVE record: opentext Flipper · CVSS 1.0 Low · Not analysed yet · Published 20 Oct 2025 · Tags: CWE-1220
- [NEOJAPAN Inc. ChatLuck: ChatLuck contains an insufficient granularity of access control vulnerability in…](https://agentprime.io/advisories/CVE-2025-54461.md)
  `CVE-2025-54461` · CVE record: NEOJAPAN Inc. ChatLuck · CVSS 6.9 Medium · Not analysed yet · Published 16 Oct 2025 · Tags: CWE-1220
- [Freeipa: idm: privilege escalation from host to domain admin in freeipa](https://agentprime.io/advisories/CVE-2025-7493.md)
  `CVE-2025-7493` · CVE record: Red Hat Red Hat Enterprise Linux 10 and 4 more · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 30 Sept 2025 · Tags: CWE-1220
- [Improper input validation in the system management mode (SMM) could allow a privileged attacker to overwrite arbitrary memory potentially resulting in arbitrary code execution at the SMM level.](https://agentprime.io/advisories/CVE-2024-21947.md)
  `CVE-2024-21947` · CVE record: AMD AMD Ryzen™ Threadripper™ 3000 Processors and 4 more · CVSS 7.5 High · Not analysed yet · Published 6 Sept 2025 · Tags: CWE-1220
- [HCL Connections is vulnerable to broken access control](https://agentprime.io/advisories/CVE-2025-31961.md)
  `CVE-2025-31961` · CVE record: HCL Software Connections · CVSS 3.7 Low · Not analysed yet · Published 15 Aug 2025 · Tags: CWE-1220
- [Insufficient Granularity of Access Control in GitLab](https://agentprime.io/advisories/CVE-2025-2498.md)
  `CVE-2025-2498` · CVE record: GitLab GitLab · CVSS 3.1 Low · Not analysed yet · Published 13 Aug 2025 · Tags: CWE-1220
- [Intel(R) Xeon(R) 6 Scalable processors: Insufficient granularity of access control in the OOB-MSM for some Intel(R) Xeon(R) 6…](https://agentprime.io/advisories/CVE-2025-22839.md)
  `CVE-2025-22839` · CVE record: Intel(R) Xeon(R) 6 Scalable processors · CVSS 7.3 High · Not analysed yet · Published 12 Aug 2025 · Tags: CWE-1220
- [Insufficient Granularity of Access Control in GitLab](https://agentprime.io/advisories/CVE-2025-7001.md)
  `CVE-2025-7001` · CVE record: GitLab GitLab · CVSS 4.3 Medium · Not analysed yet · Published 24 Jul 2025 · Tags: CWE-1220
- [Data Inference in Now Platform via Conditional ACLs](https://agentprime.io/advisories/CVE-2025-3648.md)
  `CVE-2025-3648` · CVE record: ServiceNow Now Platform · CVSS 8.2 High · Not analysed yet · Published 8 Jul 2025 · Tags: CWE-1220
- [Improper Access Control Granularity impacting Infinera G42](https://agentprime.io/advisories/CVE-2025-27026.md)
  `CVE-2025-27026` · CVE record: Infinera G42 · CVSS 4.9 Medium · Not analysed yet · Published 2 Jul 2025 · Tags: CWE-1220
- [Freeipa: idm: privilege escalation from host to domain admin in freeipa](https://agentprime.io/advisories/CVE-2025-4404.md)
  `CVE-2025-4404` · CVE record: Red Hat Red Hat Enterprise Linux 10 and 4 more · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 17 Jun 2025 · Tags: CWE-1220
- [Insufficient Granularity of Access Control in GitLab](https://agentprime.io/advisories/CVE-2025-5982.md)
  `CVE-2025-5982` · CVE record: GitLab GitLab · CVSS 3.7 Low · Not analysed yet · Published 12 Jun 2025 · Tags: CWE-1220
- [Insufficient Granularity of Access Control in GitLab](https://agentprime.io/advisories/CVE-2025-1110.md)
  `CVE-2025-1110` · CVE record: GitLab GitLab · CVSS 2.7 Low · Not analysed yet · Published 22 May 2025 · Tags: CWE-1220
- [Insufficient Granularity of Access Control in GitLab](https://agentprime.io/advisories/CVE-2025-4979.md)
  `CVE-2025-4979` · CVE record: GitLab GitLab · CVSS 4.9 Medium · Not analysed yet · Published 22 May 2025 · Tags: CWE-1220
- [Visual Studio Information Disclosure Vulnerability](https://agentprime.io/advisories/CVE-2025-32703.md)
  `CVE-2025-32703` · CVE record: Microsoft Microsoft Visual Studio 2017 version 15.9 (includes 15.0 - 15.8) and 4 more · CVSS 5.5 Medium · Not analysed yet · Published 13 May 2025 · Tags: Information disclosure, CWE-1220
- [Insufficient Granularity of Access Control in GitLab](https://agentprime.io/advisories/CVE-2025-1278.md)
  `CVE-2025-1278` · CVE record: GitLab GitLab · CVSS 5.3 Medium · Not analysed yet · Published 9 May 2025 · Tags: CWE-1220
- [This issue was addressed by removing the vulnerable code.](https://agentprime.io/advisories/CVE-2025-31201.md)
  `CVE-2025-31201` · CVE record: Apple iOS and iPadOS and 3 more · CVSS 9.8 Critical · Critical (KEV, CVSS 9+, CVSS 7+ and EPSS) · In CISA KEV · EPSS 0.14 · Not analysed yet · Published 16 Apr 2025 · Tags: CWE-1220
- [Insufficient Granularity of Access Control in GitLab](https://agentprime.io/advisories/CVE-2025-2408.md)
  `CVE-2025-2408` · CVE record: GitLab GitLab · CVSS 5.3 Medium · Not analysed yet · Published 10 Apr 2025 · Tags: CWE-1220
- [Insufficient Granularity of Access Control in Core](https://agentprime.io/advisories/CVE-2024-33058.md)
  `CVE-2024-33058` · CVE record: Qualcomm, Inc. Snapdragon · CVSS 7.5 High · Not analysed yet · Published 7 Apr 2025 · Tags: CWE-1220
- [Dell PowerProtect Data Domain with Data Domain Operating System (DD OS) versions prior to 8.3.0.15 contain an Insufficient Granularity of Access Control vulnerability.](https://agentprime.io/advisories/CVE-2025-29987.md)
  `CVE-2025-29987` · CVE record: Dell DD OS 8.3 and 3 more · CVSS 8.8 High · Not analysed yet · Published 3 Apr 2025 · Tags: CWE-1220
- [Unauthenticated Miniflux user can bypass allowed networks check to obtain Prometheus metrics](https://agentprime.io/advisories/GHSA-3qjf-qh38-x73v.md)
  `GHSA-3qjf-qh38-x73v`, `CVE-2023-27591` · Go `miniflux.app` and 1 more: affected `<=1.0.46`, no fixed version yet · CVSS 7.5 High · Not analysed yet · Published 2 Apr 2025 · Tags: Information disclosure, CWE-1220
- [Insufficient Granularity of Access Control in GitLab](https://agentprime.io/advisories/CVE-2024-12619.md)
  `CVE-2024-12619` · CVE record: GitLab GitLab · CVSS 5.2 Medium · Not analysed yet · Published 28 Mar 2025 · Tags: CWE-1220
- [Cisco Nexus 3000 and 9000 Series Switches Layer 2 Ethernet Denial of Service Vulnerability](https://agentprime.io/advisories/CVE-2025-20111.md)
  `CVE-2025-20111` · CVE record: Cisco Cisco NX-OS Software · CVSS 7.4 High · Not analysed yet · Published 26 Feb 2025 · Tags: CWE-1220
- [Hitachi Vantara Pentaho Business Analytics Server - Insufficient Granularity of Access Control](https://agentprime.io/advisories/CVE-2024-6696.md)
  `CVE-2024-6696` · CVE record: Hitachi Vantara Pentaho Data Integration & Analytics and 1 more · CVSS 4.9 Medium · Not analysed yet · Published 19 Feb 2025 · Tags: CWE-1220
- [Intel(R) processors: Insufficient granularity of access control in UEFI firmware in some Intel(R) processors…](https://agentprime.io/advisories/CVE-2024-39279.md)
  `CVE-2024-39279` · CVE record: Intel(R) processors · CVSS 6.8 Medium · Not analysed yet · Published 12 Feb 2025 · Tags: CWE-1220
- [Improper input validation in AMD Crash Defender could allow an attacker to provide the Windows® system process ID to a kernel-mode driver, resulting in an operating system crash, potentially leading…](https://agentprime.io/advisories/CVE-2024-21971.md)
  `CVE-2024-21971` · CVE record: AMD AMD Ryzen™ 5000 Series Desktop Processors and 4 more · CVSS 5.5 Medium · Not analysed yet · Published 12 Feb 2025 · Tags: CWE-1220
- [Improper input validation in the SMM handler may allow a privileged attacker to overwrite SMRAM, potentially leading to arbitrary code execution.](https://agentprime.io/advisories/CVE-2023-31343.md)
  `CVE-2023-31343` · CVE record: AMD AMD EPYC™ 7003 Processors and 4 more · CVSS 7.5 High · Not analysed yet · Published 11 Feb 2025 · Tags: CWE-1220
- [Improper input validation in the SMM handler may allow a privileged attacker to overwrite SMRAM, potentially leading to arbitrary code execution.](https://agentprime.io/advisories/CVE-2023-31342.md)
  `CVE-2023-31342` · CVE record: AMD AMD EPYC™ 7003 Processors and 4 more · CVSS 7.5 High · Not analysed yet · Published 11 Feb 2025 · Tags: CWE-1220
- [Dell PowerProtect DD: Dell PowerProtect DD versions prior to 8.3.0.0, 7.10.1.50…](https://agentprime.io/advisories/CVE-2024-53295.md)
  `CVE-2024-53295` · CVE record: Dell PowerProtect DD · CVSS 7.8 High · Not analysed yet · Published 1 Feb 2025 · Tags: CWE-1220
- [Insufficient Granularity of Access Control in GitLab](https://agentprime.io/advisories/CVE-2024-11931.md)
  `CVE-2024-11931` · CVE record: GitLab GitLab · CVSS 6.4 Medium · Not analysed yet · Published 24 Jan 2025 · Tags: CWE-1220
- [Paragraphs table - Critical - Access bypass, Information Disclosure - SA-CONTRIB-2024-036](https://agentprime.io/advisories/CVE-2024-13272.md)
  `CVE-2024-13272` · CVE record: Drupal Paragraphs table · CVSS 6.3 Medium · Not analysed yet · Published 9 Jan 2025 · Tags: CWE-1220
- [Email Contact - Moderately critical - Access bypass - SA-CONTRIB-2024-020](https://agentprime.io/advisories/CVE-2024-13256.md)
  `CVE-2024-13256` · CVE record: Drupal Email Contact · CVSS 7.5 High · Not analysed yet · Published 9 Jan 2025 · Tags: CWE-1220
- [Helm Lacks Granularity in Workflow Role](https://agentprime.io/advisories/CVE-2024-52814.md)
  `CVE-2024-52814` · CVE record: argoproj argo-helm · CVSS 2.8 Low · Not analysed yet · Published 22 Nov 2024 · Tags: CWE-1220
- [Argo Workflows Chart: Excessive Privileges in Workflow Role](https://agentprime.io/advisories/CVE-2024-52799.md)
  `CVE-2024-52799` · CVE record: argoproj argo-helm · CVSS 8.3 High · Not analysed yet · Published 21 Nov 2024 · Tags: Privilege escalation, CWE-1220
- [Outlook for Android Elevation of Privilege Vulnerability](https://agentprime.io/advisories/CVE-2024-43604.md)
  `CVE-2024-43604` · CVE record: Microsoft Microsoft Outlook for Android · CVSS 5.7 Medium · Not analysed yet · Published 8 Oct 2024 · Tags: CWE-1220
- [cgi.force_redirect configuration is bypassable due to the environment variable collision](https://agentprime.io/advisories/CVE-2024-8927.md)
  `CVE-2024-8927` · CVE record: PHP Group PHP · CVSS 7.5 High · Not analysed yet · Published 8 Oct 2024 · Tags: CWE-1220
- [Withdrawn Advisory: Lunary information disclosure vulnerability](https://agentprime.io/advisories/GHSA-9jmp-j63g-8x6m.md)
  `GHSA-9jmp-j63g-8x6m`, `CVE-2024-6867` · npm `lunary`: affected `<1.4.10`, fixed in `1.4.10` · CVSS 4.3 Medium · Withdrawn · Not analysed yet · Published 13 Sept 2024 · Tags: CWE-1220
- [usememos/memos has Insufficient Granularity of Access Control in github.com/usememos/memos](https://agentprime.io/advisories/GHSA-f83p-pg86-p922.md)
  `GHSA-f83p-pg86-p922`, `CVE-2022-4801`, `GO-2022-1235` · Go `github.com/usememos/memos`: affected `<0.9.1`, fixed in `0.9.1` · CVSS 8.2 High · Not analysed yet · Published 21 Aug 2024 · Tags: CWE-1220
- [usememos/memos has Insufficient Granularity of Access Control in github.com/usememos/memos](https://agentprime.io/advisories/GHSA-7qpw-2j9m-rw8c.md)
  `GHSA-7qpw-2j9m-rw8c`, `CVE-2022-4813`, `GO-2022-1253` · Go `github.com/usememos/memos`: affected `<0.9.1`, fixed in `0.9.1` · CVSS 8.6 High · Not analysed yet · Published 21 Aug 2024 · Tags: CWE-1220
- [Netmaker vulnerable to Insufficient Granularity of Access Control in github.com/gravitl/netmaker](https://agentprime.io/advisories/GHSA-ggf6-638m-vqmg.md)
  `GHSA-ggf6-638m-vqmg`, `CVE-2022-36110`, `GO-2022-0986` · Go `github.com/gravitl/netmaker`: affected `<0.15.1`, fixed in `0.15.1` · CVSS 8.8 High · Not analysed yet · Published 21 Aug 2024 · Tags: Broken access control, CWE-1220
- [Asterisk allows \`Write=originate\` as sufficient permissions for code execution / \`System()\` dialplan](https://agentprime.io/advisories/CVE-2024-42365.md)
  `CVE-2024-42365` · CVE record: asterisk asterisk · CVSS 7.4 High · Not analysed yet · Published 8 Aug 2024 · Tags: Privilege escalation, CWE-1220
- [aimeos/ai-admin-graphql improper access control vulnerability allows editors to manage own services](https://agentprime.io/advisories/GHSA-jj68-cp4v-98qf.md)
  `GHSA-jj68-cp4v-98qf`, `CVE-2024-39324`, `PKSA-xds6-pybz-xkzh` · Packagist `aimeos/ai-admin-graphql`: affected `>=2022.04.1, <2022.10.10 || >=2023.04.1, <2023.10.6 || >=2024.04.1, <2024.04.2`, fixed in `2022.10.10`, `2023.10.6`, `2024.04.2` · CVSS 3.8 Low · Not analysed yet · Published 2 Jul 2024 · Tags: Broken access control, CWE-1220
- [aimeos/ai-admin-graphql improper access control vulnerability allows an editor to modify admin account](https://agentprime.io/advisories/GHSA-vc7j-99jw-jrqm.md)
  `GHSA-vc7j-99jw-jrqm`, `CVE-2024-39323`, `PKSA-6xzg-vxv4-r333` · Packagist `aimeos/ai-admin-graphql`: affected `>=2022.04.1, <2022.10.10 || >=2023.04.1, <2023.10.6 || >=2024.04.1, <2024.04.6`, fixed in `2022.10.10`, `2023.10.6`, `2024.04.6` · CVSS 7.1 High · Not analysed yet · Published 2 Jul 2024 · Tags: Broken access control, CWE-1220
- [lunary-ai/lunary Access Control Vulnerability in Prompt Variation Management](https://agentprime.io/advisories/GHSA-3mwc-2cj7-gx8c.md)
  `GHSA-3mwc-2cj7-gx8c`, `CVE-2024-5389` · npm `lunary`: affected `<1.4.9`, fixed in `1.4.9` · CVSS 5.7 Medium · Withdrawn · Not analysed yet · Published 10 Jun 2024 · Tags: CWE-1220
- [Improper access control in Intel(R) Power Gadget software for macOS](https://agentprime.io/advisories/CVE-2023-40070.md)
  `CVE-2023-40070` · CVE record: Intel(R) Power Gadget software for macOS · CVSS 8.8 High · Not analysed yet · Published 16 May 2024 · Tags: Broken access control, CWE-1220
- [Improper access control in Intel(R) Power Gadget software for Windows](https://agentprime.io/advisories/CVE-2023-45217.md)
  `CVE-2023-45217` · CVE record: Intel(R) Power Gadget software for Windows · CVSS 8.8 High · Not analysed yet · Published 16 May 2024 · Tags: Broken access control, CWE-1220
- [IBM Spectrum Fusion HCI improper access control](https://agentprime.io/advisories/CVE-2023-43040.md)
  `CVE-2023-43040` · CVE record: IBM Spectrum Fusion HCI · CVSS 6.5 Medium · Not analysed yet · Published 13 May 2024 · Tags: CWE-1220
- [Kimai API returns timesheet entries a user should not be authorized to view](https://agentprime.io/advisories/GHSA-cj3c-5xpm-cx94.md)
  `GHSA-cj3c-5xpm-cx94`, `CVE-2024-29200`, `PKSA-x5fv-txyx-qvzn` · Packagist `kimai/kimai`: affected `<2.13.0`, fixed in `2.13.0` · CVSS 6.8 Medium · Not analysed yet · Published 29 Mar 2024 · Tags: CWE-1220

Newest: <https://agentprime.io/advisories/tag/cwe-1220.md>
Older: <https://agentprime.io/advisories/tag/cwe-1220.md?cursor=WyIyMDI0LTAzLTI5VDE5OjA1OjQ5LjAwMDAwMFoiLCJHSFNBLWNqM2MtNXhwbS1jeDk0Il0>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=cwe-1220&cursor=WyIyMDI2LTA0LTA3VDIyOjMzOjA1LjM1NjAwMFoiLCJDVkUtMjAyNS0yMDYyOCJd>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/cwe-1220/?cursor=WyIyMDI2LTA0LTA3VDIyOjMzOjA1LjM1NjAwMFoiLCJDVkUtMjAyNS0yMDYyOCJd>. Everything for agents: <https://agentprime.io/llms.txt>.