CWE-1220
CWE-1220 · 25 records · 10 with a public proof-of-concept
Records the NVD classes under CWE-1220, highest CVSS first.
- HIGH 8.1CVE-2026-123803public PoC
SuperTokens Core is an open source authentication server. From 10.1.0 until 11.0.9, 11.1.4, 11.2.4, 11.3.8, 11.4.8, 12.0.11, 12.1.2, 12.2.1, and 12.3.1, loadOptionsById_Transaction and getUserInfoByCredentialId_Transaction perform application-scoped WebAuthn l…
- HIGH 8.1CVE-2026-123802public PoC
SuperTokens Core is an open source authentication server. From 11.3.0 until 11.3.8, 11.4.8, 12.0.11, 12.1.2, 12.2.1, and 12.3.1, a licensed deployment with a configured SAML client can authenticate an identity from an assertion that did not satisfy the audienc…
- HIGH 8.1CVE-2026-57202public PoC
Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3, an authenticated Asterisk REST Interface (ARI) attacker with read-only privileges may …
- HIGH 7.8CVE-2026-83499
Insufficient granularity of access control in Windows Server Update Service allows an authorized attacker to elevate privileges locally.
- HIGH 7.8CVE-2026-81969
Insufficient granularity of access control in Windows Server Update Service allows an authorized attacker to elevate privileges locally.
- HIGH 7.8CVE-2026-70218
Insufficient granularity of access control in Windows StateRepository API allows an authorized attacker to elevate privileges locally.
- HIGH 7.7CVE-2026-77779
ManageEngine Key Manager Plus versions before 7151 were vulnerable to an Improper Access Control vulnerability that allowed authenticated low-privilege users to export keys outside their authorized scope.
- HIGH 7.5CVE-2026-122169
Insufficient granularity of access control in Windows IKE Extension allows an authorized attacker to perform spoofing locally.
- HIGH 7.1CVE-2026-109797public PoC
In SAP/astonish, an authenticated user could potentially identify and operate on another team�s sandbox containers because of improper tenant isolation in the legacy Incus sandbox-management API handlers. The affected handlers did not use the tenant-aware sess…
- HIGH 7.1CVE-2026-77778
ZohoCorp ManageEngine Key Manager Plus versions up to 7150 allow authenticated users to export certificates belonging to other users to their own registered key vaults.
- HIGH 7.1CVE-2026-77777
ManageEngine Key Manager Plus versions before 7151 are vulnerable to an improper access control issue that allow authenticated users to modify another user's ACME certificate deployment credentials.
- MEDIUM 6.7CVE-2026-92539
A service account with user-management permissions in one organization can read, modify, disable or delete users belonging to other organizations on the same Grafana instance through the SCIM API (insecure direct object reference). Only Grafana Enterprise inst…
- MEDIUM 6.3CVE-2026-93294
A user with query access to an Azure Monitor data source can use its resource proxy to call Azure Resource Manager APIs beyond those Grafana needs, with the data source's Azure identity (unintended proxy). The impact is bounded by the Azure role granted to tha…
- MEDIUM 5.9CVE-2026-78433public PoC
Gitea's web attachment handler skips its cross-repository ownership check for attachments created before 16 January 2026 and checks permissions against the repository named in the request URL instead. An unauthenticated attacker who knows a private attachment'…
- MEDIUM 5.5CVE-2026-111885public PoC
phpMyFAQ from 4.2.0-alpha before 4.2.0-beta contains a missing authorization vulnerability in GroupController::deleteGroup() that omits privilege-level checks on target groups. Authenticated non-SuperAdmin administrators holding GROUP_DELETE can send a crafted…
- MEDIUM 5.5CVE-2026-70216
Insufficient granularity of access control in Windows Mobile Device Management allows an authorized attacker to perform tampering locally.
- MEDIUM 5.4CVE-2026-96372
Insufficient Granularity of Access Control vulnerability in Drupal Webform allows Forceful Browsing. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.
- MEDIUM 4.8CVE-2026-85316public PoC
Insufficient Granularity of Access Control vulnerability in Apache Camel Platform HTTP component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1. The component decided whether an endpoint ran in proxy mode by testing whe…
- MEDIUM 4.3CVE-2026-104867public PoC
Immich is a high-performance self-hosted photo and video management solution. From 3.0.0 until 3.2.0, the GET /api/admin/users/{id}/calendar-heatmap route in server/src/controllers/user-admin.controller.ts uses the ordinary Permission.UserRead permission witho…
- MEDIUM 4.3CVE-2026-119627public PoC
The web profile and RSS/Atom feed routes of users and organizations checked only whether a signed-in viewer could see a limited-visibility owner, without considering the `public-only` restriction of the personal access token used to authenticate. Any user hold…
- MEDIUM 4.3CVE-2026-14210
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.11 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an authenticated user with a project-scoped fine-grained Personal Acce…
gitlab
- UNSCOREDCVE-2025-54504
Insufficient Granularity of Access Control in AMD Secure Encrypted Virtualization (SEV) firmware could allow an attacker with administrative privileges attacker to write to a trusted region used by AMD Secure Encrypted Virtualization-Encrypted State (SEV-ES), …
- UNSCOREDCVE-2026-57892
Insufficient granularity of access control in the MigTD v2 policy evaluation engine for the Intel(R) TDX Migration Trust Domain (MigTD) within Ring 0: Hypervisor may allow an escalation of privilege. Network adversary with an unauthenticated user combined with…
- UNSCOREDCVE-2026-103509
P4 Search (formerly Helix Search) returns stored credentials in cleartext through its configuration API to users with administrative privileges on the connected P4 Server, allowing privilege escalation. This affects 2026.4.2 and earlier and is fixed in 2026.4.…
- UNSCOREDCVE-2026-86338public PoC
Ash field_policies are documented to protect against filter-based information disclosure: when a field the actor may not see is referenced in a filter, it is replaced with an expression that evaluates to nil, so a filter cannot be used as a yes/no oracle to re…