CVE-2026-20773CWE-863broken-access-control

CVE-2026-20773

published September 14, 2026

CVSS
8.5
EPSS
0%
Percentile
10.3
In the wild
Unconfirmed
What it is

A role-based access control issue was identified in the administrative expression evaluation functionality. This could allow users with certain administrative roles to access expression testing capabilities beyond their intended permissions.

The record
Technical detail
CVSS
8.5 · NONE
CVSS v4.0
8.5 · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:H/SA:H
EPSS
0.00207 · 10.3th percentile
Weakness
CWE-863 · Incorrect Authorization
Published
2026-09-14T15:17Z
References (1)
https://support.pingidentity.com/s/article/SECADV054-Improper-Authorization-in-PingFederate-Administrative-Expression-Evaluation-Endpoint · [email protected]
EPSS history
Timeline
  • 16 SEP 04:25Z
    EPSS moved — → 0%
    epss
  • 14 SEP 10:43Z
    Improper Authorization in PingFederate Administrative Expression Evaluation Endpoint
    cvelistv5