EUVD-2026-77769Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
PR:L because any authenticated app user exploits the flaw; S:C because impact extends beyond TEAM to managed AWS accounts; A:L because access revocation is possible but service continuity is not fully disrupted.
Primary rating from Vendor (AMZN).
CVSS VectorVendor: AMZN
Lifecycle Timeline
6DescriptionCVE.org
Incorrect privilege assignment in Temporary Elevated Access Management (TEAM) for AWS IAM Identity Center solution before version 1.5.1 might allow an authenticated remote user with application-level access to read, approve, modify, or revoke arbitrary access requests, thereby obtaining unintended temporary elevated access to the AWS accounts accessed using the TEAM deployment.
This issue has been addressed in TEAM version 1.5.1 or later. We recommend upgrading to the latest version and ensuring any forked or derivative code is patched to incorporate the new fixes.
AnalysisAI
Incorrect privilege assignment in the AWS Temporary Elevated Access Management (TEAM) solution for IAM Identity Center (all versions before 1.5.1) permits any authenticated application user to read, approve, modify, or revoke arbitrary access requests - effectively enabling self-approval of elevated permissions to AWS accounts managed by the TEAM deployment. The root cause is an improperly scoped Cognito Identity Pool that fails to enforce authorization boundaries between regular requesters and privileged approvers or administrators, compounded by client-side derivation of account names and roles. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires a valid authenticated session within the TEAM application via AWS Cognito - this corresponds to any enrolled TEAM user (requester, viewer, or lower-privilege role), not only approvers or administrators. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The official CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:H) yields a score of 8.6, but the PR:H designation appears overcalibrated relative to the description's 'application-level access' language, which maps to PR:L - any authenticated TEAM user, not just administrators, can exploit the flaw, making the real-world attack surface broader than the official vector implies. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade to TEAM version 1.5.1 or later, available at https://github.com/aws-samples/iam-identity-center-team/releases/tag/v1.5.1. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all AWS TEAM deployments and determine the total population of authenticated users with system access; simultaneously review access approval logs for the last 90 days to identify any anomalous self-approvals or cross-user modifications. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-266 – Incorrect Privilege Assignment
View allShare
External POC / Exploit Code
Leaving vuln.today