Advisories · Weakness
CWE-1220.
Every Advisory and CVE whose sources give the weakness CWE-1220, newest first.
- CVSS 8.2 High
Vite Vulnerable to Arbitrary File Read via Vite Dev Server WebSocket
- Information disclosure
- Authentication bypass
>=6.0.0, <6.4.2 || >=7.0.0, <7.3.2 || >=8.0.0, <8.0.5 · fixed in 6.4.2, 7.3.2, 8.0.5
GHSA-p9ff-h696-f583 · CVE-2026-39363 - CVSS 7.4 High
FastMCP OAuth Proxy token reuse across MCP servers
- Broken access control
- CWE-1220
<2.14.2 · fixed in 2.14.2
GHSA-5h2m-4q8j-pqpj · CVE-2025-69196 - CVSS 5.5 Medium
Cisco Application Policy Infrastructure Controller Denial of Service Vulnerability
- Cisco Application Policy Infrastructure Controller (APIC)
- CWE-1220
- CVSS 4.0 Medium
Insufficient Granularity of Access Control in SEV firmware can allow a privileged attacker to create a SEV-ES Guest to attack SNP guest, potentially resulting in a loss of confidentiality.
- AMD EPYC™ 9004 Series Processors
- AMD EPYC™ 7003 Series Processors
- CWE-1220
- CVSS 4.6 Medium
Insufficient Granularity of Access Control in SEV firmware could allow a privileged user with a malicious hypervisor to create a SEV-ES guest with an ASID in the range meant for SEV-SNP guests potent…
- AMD EPYC™ 9005 Series Processors
- AMD EPYC™ Embedded 9005 Series Processors
- CWE-1220
- CVSS 7.0 High
Intel(R) Platforms: Missing protection mechanism for alternate hardware interface in the Intel(R) Quick…
- Intel(R) Platforms
- CWE-1220
- CWE-1299
- CVSS 4.8 Medium
Privilege Elevation in Ercom Cryptobox administration console
- Ercom Cryptobox
- Cross-site scripting (XSS)
- CWE-1220
- CVSS 7.5 High
Insufficient Access Control in lunary-ai/lunary
- lunary-ai/lunary
- CWE-1220
- CVSS 5.4 Medium
Insufficient Granularity of Access Control in GitLab
- GitLab
- CWE-1220
- CVSS 5.1 Medium
Improper Access Control in Asseco Infomedica Plus
- Asseco InfoMedica Plus
- CWE-1220
- CVSS 4.3 Medium
A vulnerability in the web-based management interface of Cisco ISE could allow an authenticated, remote attacker to obtain sensitive information from an affected device.
- Cisco Identity Services Engine Software
- CWE-1220
- CVSS 2.3 Low
Insufficient Access Control vulnerability has been discovered in OpenText Flipper.
- opentext Flipper
- CWE-1220
- CVSS 1.0 Low
Insufficient access control vulnerability has been discovered in Opentext Flipper.
- opentext Flipper
- CWE-1220
- CVSS 6.9 Medium
NEOJAPAN Inc. ChatLuck: ChatLuck contains an insufficient granularity of access control vulnerability in…
- NEOJAPAN Inc. ChatLuck
- CWE-1220
- CVSS 9.1 CriticalCritical · CVSS 9+
Freeipa: idm: privilege escalation from host to domain admin in freeipa
- Red Hat Enterprise Linux 10
- Red Hat Enterprise Linux 7 Extended Lifecycle Support
- CWE-1220
- CVSS 7.5 High
Improper input validation in the system management mode (SMM) could allow a privileged attacker to overwrite arbitrary memory potentially resulting in arbitrary code execution at the SMM level.
- AMD Ryzen™ Threadripper™ 3000 Processors
- AMD Ryzen™ Threadripper™ PRO 5000 WX-Series Processors
- CWE-1220
- CVSS 3.7 Low
HCL Connections is vulnerable to broken access control
- HCL Software Connections
- CWE-1220
- CVSS 3.1 Low
Insufficient Granularity of Access Control in GitLab
- GitLab
- CWE-1220
- CVSS 7.3 High
Intel(R) Xeon(R) 6 Scalable processors: Insufficient granularity of access control in the OOB-MSM for some Intel(R) Xeon(R) 6…
- Intel(R) Xeon(R) 6 Scalable processors
- CWE-1220
- CVSS 4.3 Medium
Insufficient Granularity of Access Control in GitLab
- GitLab
- CWE-1220
- CVSS 8.2 High
Data Inference in Now Platform via Conditional ACLs
- ServiceNow Now Platform
- CWE-1220
- CVSS 4.9 Medium
Improper Access Control Granularity impacting Infinera G42
- Infinera G42
- CWE-1220
- CVSS 9.1 CriticalCritical · CVSS 9+
Freeipa: idm: privilege escalation from host to domain admin in freeipa
- Red Hat Enterprise Linux 10
- Red Hat Enterprise Linux 7 Extended Lifecycle Support
- CWE-1220
- CVSS 3.7 Low
Insufficient Granularity of Access Control in GitLab
- GitLab
- CWE-1220
- CVSS 2.7 Low
Insufficient Granularity of Access Control in GitLab
- GitLab
- CWE-1220
- CVSS 4.9 Medium
Insufficient Granularity of Access Control in GitLab
- GitLab
- CWE-1220
- CVSS 5.5 Medium
Visual Studio Information Disclosure Vulnerability
- Microsoft Visual Studio 2017 version 15.9 (includes 15.0 - 15.8)
- Microsoft Visual Studio 2019 version 16.11 (includes 16.0 - 16.10)
- Information disclosure
- CWE-1220
- CVSS 5.3 Medium
Insufficient Granularity of Access Control in GitLab
- GitLab
- CWE-1220
- CVSS 9.8 CriticalCritical · KEV, CVSS 9+, CVSS 7+ and EPSSKEV
This issue was addressed by removing the vulnerable code.
- Apple iOS and iPadOS
- Apple macOS
- CWE-1220
- CVSS 5.3 Medium
Insufficient Granularity of Access Control in GitLab
- GitLab
- CWE-1220
- CVSS 7.5 High
Insufficient Granularity of Access Control in Core
- Qualcomm, Inc. Snapdragon
- CWE-1220
- CVSS 8.8 High
Dell PowerProtect Data Domain with Data Domain Operating System (DD OS) versions prior to 8.3.0.15 contain an Insufficient Granularity of Access Control vulnerability.
- Dell DD OS 8.3
- Dell DD OS 7.13
- CWE-1220
- CVSS 7.5 High
Unauthenticated Miniflux user can bypass allowed networks check to obtain Prometheus metrics
- Information disclosure
- CWE-1220
<=1.0.46 · no fixed version yet
GHSA-3qjf-qh38-x73v · CVE-2023-27591 - CVSS 5.2 Medium
Insufficient Granularity of Access Control in GitLab
- GitLab
- CWE-1220
- CVSS 7.4 High
Cisco Nexus 3000 and 9000 Series Switches Layer 2 Ethernet Denial of Service Vulnerability
- Cisco NX-OS Software
- CWE-1220
- CVSS 4.9 Medium
Hitachi Vantara Pentaho Business Analytics Server - Insufficient Granularity of Access Control
- Hitachi Vantara Pentaho Data Integration & Analytics
- Hitachi Vantara Pentaho Business Analytics Server
- CWE-1220
- CVSS 6.8 Medium
Intel(R) processors: Insufficient granularity of access control in UEFI firmware in some Intel(R) processors…
- Intel(R) processors
- CWE-1220
- CVSS 5.5 Medium
Improper input validation in AMD Crash Defender could allow an attacker to provide the Windows® system process ID to a kernel-mode driver, resulting in an operating system crash, potentially leading…
- AMD Ryzen™ 5000 Series Desktop Processors
- AMD Ryzen™ 5000 Series Desktop Processor with Radeon™ Graphics
- CWE-1220
- CVSS 7.5 High
Improper input validation in the SMM handler may allow a privileged attacker to overwrite SMRAM, potentially leading to arbitrary code execution.
- AMD EPYC™ 7003 Processors
- AMD EPYC™ 9004 Processors
- CWE-1220
- CVSS 7.5 High
Improper input validation in the SMM handler may allow a privileged attacker to overwrite SMRAM, potentially leading to arbitrary code execution.
- AMD EPYC™ 7003 Processors
- AMD EPYC™ 9004 Processors
- CWE-1220
- CVSS 7.8 High
Dell PowerProtect DD: Dell PowerProtect DD versions prior to 8.3.0.0, 7.10.1.50…
- Dell PowerProtect DD
- CWE-1220
- CVSS 6.4 Medium
Insufficient Granularity of Access Control in GitLab
- GitLab
- CWE-1220
- CVSS 6.3 Medium
Paragraphs table - Critical - Access bypass, Information Disclosure - SA-CONTRIB-2024-036
- Drupal Paragraphs table
- CWE-1220
- CVSS 7.5 High
Email Contact - Moderately critical - Access bypass - SA-CONTRIB-2024-020
- Drupal Email Contact
- CWE-1220
- CVSS 2.8 Low
Helm Lacks Granularity in Workflow Role
- argoproj argo-helm
- CWE-1220
- CVSS 8.3 High
Argo Workflows Chart: Excessive Privileges in Workflow Role
- argoproj argo-helm
- Privilege escalation
- CWE-1220
- CVSS 5.7 Medium
Outlook for Android Elevation of Privilege Vulnerability
- Microsoft Outlook for Android
- CWE-1220
- CVSS 7.5 High
cgi.force_redirect configuration is bypassable due to the environment variable collision
- PHP
- CWE-1220
- CVSS 4.3 Medium
Withdrawn Advisory: Lunary information disclosure vulnerability
- CWE-1220
<1.4.10 · fixed in 1.4.10
GHSA-9jmp-j63g-8x6m · CVE-2024-6867 - CVSS 8.2 High
usememos/memos has Insufficient Granularity of Access Control in github.com/usememos/memos
- CWE-1220
<0.9.1 · fixed in 0.9.1
GHSA-f83p-pg86-p922 · CVE-2022-4801 - CVSS 8.6 High
usememos/memos has Insufficient Granularity of Access Control in github.com/usememos/memos
- CWE-1220
<0.9.1 · fixed in 0.9.1
GHSA-7qpw-2j9m-rw8c · CVE-2022-4813 - CVSS 8.8 High
Netmaker vulnerable to Insufficient Granularity of Access Control in github.com/gravitl/netmaker
- Broken access control
- CWE-1220
<0.15.1 · fixed in 0.15.1
GHSA-ggf6-638m-vqmg · CVE-2022-36110 - CVSS 7.4 High
Asterisk allows `Write=originate` as sufficient permissions for code execution / `System()` dialplan
- asterisk
- Privilege escalation
- CWE-1220
- CVSS 3.8 Low
aimeos/ai-admin-graphql improper access control vulnerability allows editors to manage own services
- Broken access control
- CWE-1220
>=2022.04.1, <2022.10.10 || >=2023.04.1, <2023.10.6 || >=2024.04.1, <2024.04.2 · fixed in 2022.10.10, 2023.10.6, 2024.04.2
GHSA-jj68-cp4v-98qf · CVE-2024-39324 - CVSS 7.1 High
aimeos/ai-admin-graphql improper access control vulnerability allows an editor to modify admin account
- Broken access control
- CWE-1220
>=2022.04.1, <2022.10.10 || >=2023.04.1, <2023.10.6 || >=2024.04.1, <2024.04.6 · fixed in 2022.10.10, 2023.10.6, 2024.04.6
GHSA-vc7j-99jw-jrqm · CVE-2024-39323 - CVSS 5.7 Medium
lunary-ai/lunary Access Control Vulnerability in Prompt Variation Management
- CWE-1220
<1.4.9 · fixed in 1.4.9
GHSA-3mwc-2cj7-gx8c · CVE-2024-5389 - CVSS 8.8 High
Improper access control in Intel(R) Power Gadget software for macOS
- Intel(R) Power Gadget software for macOS
- Broken access control
- CWE-1220
- CVSS 8.8 High
Improper access control in Intel(R) Power Gadget software for Windows
- Intel(R) Power Gadget software for Windows
- Broken access control
- CWE-1220
- CVSS 6.5 Medium
IBM Spectrum Fusion HCI improper access control
- IBM Spectrum Fusion HCI
- CWE-1220
- CVSS 6.8 Medium
Kimai API returns timesheet entries a user should not be authorized to view
- CWE-1220
<2.13.0 · fixed in 2.13.0
GHSA-cj3c-5xpm-cx94 · CVE-2024-29200