CWE-1220 · 110 records

Insufficient Granularity of Access Control

CVEs in this class

110 records

CVE records
Action	CVE	Vulnerability	Severity	KEV	EPSS	Published
73This week	CVE-2025-31201Weaponized	This issue was addressed by removing the vulnerable code.apple · macos · CWE-1220 Pre-auth	Critical9.8	KEV	13.9%	Apr 16, 2025
63This week	CVE-2026-33825Weaponized	Microsoft Defender Elevation of Privilege Vulnerabilitymicrosoft · defender antimalware platform · CWE-1220 Local privilege escalation	High7.8	KEV	6.7%	Apr 14, 2026
61This week	CVE-2026-56155Weaponized	Active Directory Federation Services Elevation of Privilege Vulnerabilitymicrosoft · windows 10 1607 · CWE-1220 Local privilege escalation	High7.8	KEV	0.3%	Jul 14, 2026
40Plan	CVE-2023-43040Proof of concept	IBM Spectrum Fusion HCI improper access controlibm · storage fusion hci · CWE-1220 Pre-auth	Critical9.8	—	3.0%	May 14, 2024
39Monitor	GHSA-47wq-cj9q-wpmpNo exploit	Paperclip: Cross-tenant agent API token minting via missing assertCompanyAccess on /api/agents/:id/keysnpm · @paperclipai/server · CWE-1220	Critical9.9	—	—	Apr 16, 2026
38Monitor	CVE-2026-6356Proof of concept	A vulnerability in the web application allows standard users to escalate their privileges to those of a super administrator through parameteaugmentt · augmentt · CWE-1220	Critical9.6	—	0.2%	Apr 22, 2026
37Monitor	CVE-2025-4404Proof of concept	Freeipa: idm: privilege escalation from host to domain admin in freeipared hat · red hat enterprise linux 10 · CWE-1220	Critical9.1	—	1.9%	Jun 17, 2025
36Monitor	CVE-2025-7493No exploit	Freeipa: idm: privilege escalation from host to domain admin in freeipared hat · red hat enterprise linux 10 · CWE-1220	Critical9.1	—	0.5%	Sep 30, 2025
36Monitor	CVE-2026-6388No exploit	Argocd-image-updater: argocd image updater: cross-namespace privilege escalation via insufficient namespace validationred hat · red hat openshift gitops · CWE-1220	Critical9.1	—	0.3%	Apr 15, 2026
35Monitor	CVE-2026-40365No exploit	Microsoft SharePoint Server Remote Code Execution Vulnerabilitymicrosoft · sharepoint server · CWE-1220 RCE Deserialization	High8.8	—	0.9%	May 12, 2026
35Monitor	CVE-2026-66814No exploit	Microsoft SQL Server Elevation of Privilege Vulnerabilitymicrosoft · sql server 2017 · CWE-1220	High8.8	—	0.7%	Sep 8, 2026
35Monitor	CVE-2026-77480No exploit	SQL Server Elevation of Privilege Vulnerabilitymicrosoft · sql server 2017 · CWE-1220	High8.8	—	0.7%	Sep 8, 2026
35Monitor	CVE-2022-2475No exploit	Haas Controller version 100.20.000.1110 has insufficient granularity of access control when using the "Ethernet Q Commands" service.haascnc · haas controller firmware · CWE-1220	High8.8	—	0.7%	Oct 28, 2022
35Monitor	CVE-2026-50502No exploit	Windows Event Logging Service Remote Code Execution Vulnerabilitymicrosoft · windows 10 1607 · CWE-1220 RCE	High8.8	—	0.6%	Jul 14, 2026
35Monitor	CVE-2025-29987No exploit	Dell PowerProtect Data Domain with Data Domain Operating System (DD OS) versions prior to 8.3.0.15 contain an Insufficient Granularity of Acdell · powerprotect data domain · CWE-1220 RCE	High8.8	—	0.5%	Apr 3, 2025
35Monitor	CVE-2026-35436No exploit	Microsoft Office Click-To-Run Elevation of Privilege Vulnerabilitymicrosoft · 365 apps · CWE-1220 Local privilege escalation	High8.8	—	0.2%	May 12, 2026
34Monitor	CVE-2026-103509No exploit	Credential Disclosure in P4 Search Configuration APIperforce · p4 (helix core) · CWE-1220	High8.5	—	0.2%	Oct 15, 2026
34Monitor	CVE-2024-21962No exploit	Improper Input Validation in the AMD RAID driver could allow an attacker to point to an arbitrary memory location potentially resulting in pamd · amd epyc™ 4005 series processors · CWE-1220 RCE Local privilege escalation	High8.6	—	0.1%	May 15, 2026
33Monitor	CVE-2023-33127No exploit	.NET and Visual Studio Elevation of Privilege Vulnerabilitymicrosoft · .net · CWE-1220 Pre-auth	High8.1	—	1.8%	Jul 11, 2023
33Monitor	CVE-2025-3648No exploit	Data Inference in Now Platform via Conditional ACLsservicenow · now platform · CWE-1220 Pre-auth	High8.2	—	1.6%	Jul 8, 2025
33Monitor	CVE-2026-78122Proof of concept	docker-socket-proxy through 0.5.0 Insufficient Access Control Granularity Exposes Container Filesystemstecnativa · docker-socket-proxy · CWE-1220 Pre-auth	High8.3	—	0.3%	Aug 22, 2026
32Monitor	CVE-2024-43604No exploit	Outlook for Android Elevation of Privilege Vulnerabilitymicrosoft · outlook · CWE-1220	High8.0	—	1.1%	Oct 8, 2024
32Monitor	CVE-2024-5389No exploit	Insufficient Access Control in lunary-ai/lunarylunary · lunary · CWE-1220	High8.1	—	0.4%	Jun 9, 2024
31Monitor	CVE-2026-81969No exploit	Windows Server Update Service Elevation of Privilege Vulnerabilitymicrosoft · windows 10 1607 · CWE-1220 Local privilege escalation	High7.8	—	0.3%	Oct 13, 2026
31Monitor	CVE-2026-83499No exploit	Windows Server Update Service Elevation of Privilege Vulnerabilitymicrosoft · windows 10 1607 · CWE-1220 Local privilege escalation	High7.8	—	0.3%	Oct 13, 2026

CVE-2025-31201
73This week
This issue was addressed by removing the vulnerable code.
CriticalCVSS 9.8KEVWeaponizedEPSS 13%
- Pre-auth
apple · macosApr 16, 2025
CVE-2026-33825
63This week
Microsoft Defender Elevation of Privilege Vulnerability
HighCVSS 7.8KEVWeaponizedEPSS 6%
- Local privilege escalation
microsoft · defender antimalware platformApr 14, 2026
CVE-2026-56155
61This week
Active Directory Federation Services Elevation of Privilege Vulnerability
HighCVSS 7.8KEVWeaponizedEPSS 0%
- Local privilege escalation
microsoft · windows 10 1607Jul 14, 2026
CVE-2023-43040
40Plan
IBM Spectrum Fusion HCI improper access control
CriticalCVSS 9.8Proof of conceptEPSS 3%
- Pre-auth
ibm · storage fusion hciMay 14, 2024
GHSA-47wq-cj9q-wpmp
39Monitor
Paperclip: Cross-tenant agent API token minting via missing assertCompanyAccess on /api/agents/:id/keys
CriticalCVSS 9.9No exploit
npm · @paperclipai/serverApr 16, 2026
CVE-2026-6356
38Monitor
A vulnerability in the web application allows standard users to escalate their privileges to those of a super administrator through paramete
CriticalCVSS 9.6Proof of conceptEPSS 0%
augmentt · augmenttApr 22, 2026
CVE-2025-4404
37Monitor
Freeipa: idm: privilege escalation from host to domain admin in freeipa
CriticalCVSS 9.1Proof of conceptEPSS 1%
red hat · red hat enterprise linux 10Jun 17, 2025
CVE-2025-7493
36Monitor
Freeipa: idm: privilege escalation from host to domain admin in freeipa
CriticalCVSS 9.1No exploitEPSS 0%
red hat · red hat enterprise linux 10Sep 30, 2025
CVE-2026-6388
36Monitor
Argocd-image-updater: argocd image updater: cross-namespace privilege escalation via insufficient namespace validation
CriticalCVSS 9.1No exploitEPSS 0%
red hat · red hat openshift gitopsApr 15, 2026
CVE-2026-40365
35Monitor
Microsoft SharePoint Server Remote Code Execution Vulnerability
HighCVSS 8.8No exploitEPSS 0%
- RCE
- Deserialization
microsoft · sharepoint serverMay 12, 2026
CVE-2026-66814
35Monitor
Microsoft SQL Server Elevation of Privilege Vulnerability
HighCVSS 8.8No exploitEPSS 0%
microsoft · sql server 2017Sep 8, 2026
CVE-2026-77480
35Monitor
SQL Server Elevation of Privilege Vulnerability
HighCVSS 8.8No exploitEPSS 0%
microsoft · sql server 2017Sep 8, 2026
CVE-2022-2475
35Monitor
Haas Controller version 100.20.000.1110 has insufficient granularity of access control when using the "Ethernet Q Commands" service.
HighCVSS 8.8No exploitEPSS 0%
haascnc · haas controller firmwareOct 28, 2022
CVE-2026-50502
35Monitor
Windows Event Logging Service Remote Code Execution Vulnerability
HighCVSS 8.8No exploitEPSS 0%
- RCE
microsoft · windows 10 1607Jul 14, 2026
CVE-2025-29987
35Monitor
Dell PowerProtect Data Domain with Data Domain Operating System (DD OS) versions prior to 8.3.0.15 contain an Insufficient Granularity of Ac
HighCVSS 8.8No exploitEPSS 0%
- RCE
dell · powerprotect data domainApr 3, 2025
CVE-2026-35436
35Monitor
Microsoft Office Click-To-Run Elevation of Privilege Vulnerability
HighCVSS 8.8No exploitEPSS 0%
- Local privilege escalation
microsoft · 365 appsMay 12, 2026
CVE-2026-103509
34Monitor
Credential Disclosure in P4 Search Configuration API
HighCVSS 8.5No exploitEPSS 0%
perforce · p4 (helix core)Oct 15, 2026
CVE-2024-21962
34Monitor
Improper Input Validation in the AMD RAID driver could allow an attacker to point to an arbitrary memory location potentially resulting in p
HighCVSS 8.6No exploitEPSS 0%
- RCE
- Local privilege escalation
amd · amd epyc™ 4005 series processorsMay 15, 2026
CVE-2023-33127
33Monitor
.NET and Visual Studio Elevation of Privilege Vulnerability
HighCVSS 8.1No exploitEPSS 1%
- Pre-auth
microsoft · .netJul 11, 2023
CVE-2025-3648
33Monitor
Data Inference in Now Platform via Conditional ACLs
HighCVSS 8.2No exploitEPSS 1%
- Pre-auth
servicenow · now platformJul 8, 2025
CVE-2026-78122
33Monitor
docker-socket-proxy through 0.5.0 Insufficient Access Control Granularity Exposes Container Filesystems
HighCVSS 8.3Proof of conceptEPSS 0%
- Pre-auth
tecnativa · docker-socket-proxyAug 22, 2026
CVE-2024-43604
32Monitor
Outlook for Android Elevation of Privilege Vulnerability
HighCVSS 8.0No exploitEPSS 1%
microsoft · outlookOct 8, 2024
CVE-2024-5389
32Monitor
Insufficient Access Control in lunary-ai/lunary
HighCVSS 8.1No exploitEPSS 0%
lunary · lunaryJun 9, 2024
CVE-2026-81969
31Monitor
Windows Server Update Service Elevation of Privilege Vulnerability
HighCVSS 7.8No exploitEPSS 0%
- Local privilege escalation
microsoft · windows 10 1607Oct 13, 2026
CVE-2026-83499
31Monitor
Windows Server Update Service Elevation of Privilege Vulnerability
HighCVSS 7.8No exploitEPSS 0%
- Local privilege escalation
microsoft · windows 10 1607Oct 13, 2026

All vulnerability classes