VULNERABILITY INTELLIGENCE

CVE-2026-17601

CVSS score8.9 HIGH
EPSS probability0.52%
CISA KEVNot currently listed
Published2026-08-07
Last modified2026-10-23
CVSS vectorCVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:L

Description

A user holding a permission to update privilege definitions could modify a wildcard privilege already assigned to their own role to grant broader permissions than they were authorized to hold, including full administrative access, without any additional authorization check or role reassignment.

Weakness classification

  • CWE-862: Missing Authorization

Primary references