EUVD-2026-45293
GHSA-gwjw-gqpv-v99g
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Network-reachable admin interface, low-privilege account required, high integrity impact; no confidentiality or availability impact described.
Primary rating from Vendor (ibm).
CVSS VectorVendor: ibm
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Lifecycle Timeline
1DescriptionCVE.org
IBM Verify Identity Access 11.0 through 11.0.2 and IBM Security Verify Access 10.0 through 10.0.9.1 and IBM Verify Identity Access Container 11.0 through 11.0.2 and IBM Security Verify Access Container 10.0 through 10.0.9.1 could allow an attacker with read-only privileges to make unauthorized modifications and deployments outside of their assigned permissions.
AnalysisAI
IBM Verify Identity Access and IBM Security Verify Access - both appliance and container deployments - expose an incorrect authorization flaw (CWE-863) that allows an authenticated attacker with read-only privileges to perform unauthorized modifications and deployments outside their assigned permission scope. Affected versions span IBM Verify Identity Access 11.0-11.0.2, IBM Security Verify Access 10.0-10.0.9.1, and their respective Container variants. A vendor patch is available per IBM advisory 7279510; no public exploit code or CISA KEV listing has been identified at time of analysis.
Technical ContextAI
The vulnerability is rooted in CWE-863 (Incorrect Authorization), meaning the application fails to properly enforce access control checks when a low-privileged (read-only) principal attempts write or deploy operations. IBM Verify Identity Access and IBM Security Verify Access are enterprise identity and access management (IAM) platforms used for authentication, authorization, and federation services; the Container variants are the Kubernetes/OpenShift-packaged editions. CPE data confirms four distinct product lines are affected: cpe:2.3:a:ibm:verify_identity_access, cpe:2.3:a:ibm:security_verify_access, cpe:2.3:a:ibm:verify_identity_access_container, and cpe:2.3:a:ibm:security_verify_access_container. The root cause is likely a missing or incorrectly evaluated authorization gate on administrative APIs or configuration endpoints that allows role-elevation behavior - a read-only account can bypass the permission model to invoke privileged operations such as configuration deployment.
RemediationAI
The primary remediation is to apply the vendor-released patch per IBM Security Advisory 7279510 at https://www.ibm.com/support/pages/node/7279510. The advisory should be consulted for the exact fixed versions, as the input data confirms patch availability without specifying the precise patched release numbers - apply the latest available fix for the applicable product line (Verify Identity Access 11.0.x, Security Verify Access 10.0.x, or their Container equivalents). As a compensating control prior to patching, organizations should audit and minimize the number of accounts granted any level of access to the administrative interfaces of the IAM platform, as exploitation requires an existing authenticated low-privilege account. Restricting network access to administrative endpoints (e.g., via firewall rules, network segmentation, or a jump host) reduces exposure since the attack vector is network-based. Enabling audit logging on deployment and modification operations can help detect unauthorized changes. These controls do not eliminate the vulnerability but reduce the window of opportunity while patching proceeds.
More in Verify Identity Access
View allFormat string injection in IBM Security Verify Access (10.0-10.0.9.2) and IBM Verify Identity Access (11.0-11.0.3, inclu
Authentication bypass in IBM Security Verify Access and IBM Verify Identity Access exposes protected resources to unauth
Privilege escalation in IBM Security Verify Access and IBM Verify Identity Access allows an authenticated low-privilege
Local code execution in IBM Security Verify Access 10.0-10.0.9.1 and 11.0-11.0.2 (both container and non-container deplo
Local privilege escalation to root in IBM Verify/Security Verify Access products 10.0-11.0.2 allows unauthenticated loca
Denial of service in IBM Security Verify Access and IBM Verify Identity Access - including container editions - allows r
Authentication bypass in IBM Security Verify Access 10.0-10.0.9.2 and IBM Verify Identity Access 11.0-11.0.3 (including
Privilege escalation via command injection in IBM Security Verify Access and IBM Verify Identity Access allows an authen
OS command injection in IBM Security Verify Access and IBM Verify Identity Access management interfaces enables already-
Server-Side Request Forgery (SSRF) in IBM Verify Identity Access and Security Verify Access products (versions 10.0-11.0
Cryptographic validation weakness in the IBM Security Verify Access / Verify Identity Access Reverse Proxy (WebSEAL) all
Open redirect vulnerability in IBM Verify Identity Access and Security Verify Access allows remote unauthenticated attac
Same weakness CWE-863 – Incorrect Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today