Iam Identity Center Team
Monthly
Incorrect privilege assignment in the AWS Temporary Elevated Access Management (TEAM) solution for IAM Identity Center (all versions before 1.5.1) permits any authenticated application user to read, approve, modify, or revoke arbitrary access requests - effectively enabling self-approval of elevated permissions to AWS accounts managed by the TEAM deployment. The root cause is an improperly scoped Cognito Identity Pool that fails to enforce authorization boundaries between regular requesters and privileged approvers or administrators, compounded by client-side derivation of account names and roles. No public exploit has been identified at time of analysis, and SSVC rates exploitation status as none.
Incorrect privilege assignment in the AWS Temporary Elevated Access Management (TEAM) solution for IAM Identity Center (all versions before 1.5.1) permits any authenticated application user to read, approve, modify, or revoke arbitrary access requests - effectively enabling self-approval of elevated permissions to AWS accounts managed by the TEAM deployment. The root cause is an improperly scoped Cognito Identity Pool that fails to enforce authorization boundaries between regular requesters and privileged approvers or administrators, compounded by client-side derivation of account names and roles. No public exploit has been identified at time of analysis, and SSVC rates exploitation status as none.