CVE-2026-86830CWE-1220CWE-266

CVE-2026-86830

High · published September 14, 2026

CVSS v3.1
7.2
EPSS
1%
Percentile
52.2
In the wild
Unconfirmed
What it is

Incorrect privilege assignment in Temporary Elevated Access Management (TEAM) for AWS IAM Identity Center solution before version 1.5.1 might allow an authenticated remote user with application-level access to read, approve, modify, or revoke arbitrary access requests, thereby obtaining unintended temporary elevated access to the AWS accounts accessed using the TEAM deployment.

This issue has been addressed in TEAM version 1.5.1 or later. We recommend upgrading to the latest version and ensuring any forked or derivative code is patched to incorporate the new fixes.

The record
Technical detail
CVSS v3.1
7.2 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
8.6 · CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS
0.00690 · 52.2th percentile
Weaknesses
CWE-1220 · Insufficient Granularity of Access Control; CWE-266 · Incorrect Privilege Assignment
Published
2026-09-14T23:17Z
References (3)
https://aws.amazon.com/security/security-bulletins/2026-112-aws/ · ff89ba41-3aa1-4d27-914a-91399e9639e5https://github.com/aws-samples/iam-identity-center-team/releases/tag/v1.5.1 · ff89ba41-3aa1-4d27-914a-91399e9639e5https://github.com/aws-samples/iam-identity-center-team/security/advisories/GHSA-6x87-mjv8-mgvj · ff89ba41-3aa1-4d27-914a-91399e9639e5
EPSS history
Timeline
  • 17 SEP 03:33Z
    EPSS moved — → 0%
    epss
  • 14 SEP 18:00Z
    Incorrect privilege assignment in Temporary Elevated Access Management (TEAM) for AWS IAM Identity Center
    cvelistv5