Pega Platform CVE-2025-9559

Requires a valid authenticated session on the Pega Platform (PR:L) and interaction with the specific user-interface component that performs the Insecure Direct Object Reference; the attacker must be able to supply or alter the object identifier the component uses to fetch data. No user interaction from a victim is needed (UI:N) and no special non-default configuration is named in the advisory. Exploitation is strictly limited to reading data - there is no write, modification, or availability impact (I:N/A:N) - and the attacker must already possess credentials, so unauthenticated outsiders cannot exploit it directly. Affected deployments are Pega Platform versions 8.7.5 through 24.2.2.

This is a moderate-priority, authorization-level issue rather than a critical emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, base 6.5) indicates a remotely reachable, low-complexity flaw that requires authenticated low-privilege access (PR:L) and yields confidentiality impact only (C:H) with no integrity or availability effect - consistent with the description of an Insecure Direct Object Reference (CWE-639) that 'can only be used to read data.' Exploitation signals are modest and mutually consistent: EPSS is 0.40% (32nd percentile), the CVE is NOT in CISA KEV, and no public POC is referenced, so there is no public exploit identified at time of analysis. No SSVC decision data was supplied. The main caveat is a labeling conflict: the input Tags include 'Authentication Bypass,' but CWE-639 and the PR:L vector describe authorization/access-control bypass by an already-authenticated user, not authentication bypass - defenders should treat this as a horizontal/vertical data-access (IDOR) issue, not a pre-auth bypass. Net: a real but bounded risk - worth patching on a normal cadence, especially in multi-tenant or externally-exposed Pega deployments where low-privileged accounts are plentiful, but not an active-exploitation fire drill.

An authenticated low-privilege Pega user (for example, a self-service portal or customer account holder) manipulates an object identifier passed to a vulnerable UI component, substituting another user's or tenant's reference value. Because the component fails to verify ownership, the server returns data the attacker is not authorized to see, enabling read-only disclosure of other users' sensitive records. The network attack vector and low complexity make this straightforward to perform with a browser or proxy, though valid credentials are required and no public exploit code is currently known.