CWE-1220
Insufficient Granularity of Access Control
The product implements access controls via a policy or other feature with the intention to disable or restrict accesses (reads and/or writes) to assets in a system from untrusted agents. However, implemented access controls lack required granularity, which renders the control policy too broad because it allows accesse…
Impactr finds and proves whether CWE-1220 — or flaws like it — are actually reachable in your own web apps and APIs, with a reproducible exploit as evidence.