Skip to content
CVE PROGRAM SOURCE RECORD8.5 High

CVE-2026-20773

Improper Authorization in PingFederate Administrative Expression Evaluation Endpoint

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
Ping Identity

Description

A role-based access control issue was identified in the administrative expression evaluation functionality. This could allow users with certain administrative roles to access expression testing capabilities beyond their intended permissions.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Ping Identity PingFederate

Default version status: unaffected

  • 13.0.0 to ≤ 13.0.1affected
  • 12.3.0 to ≤ 12.3.5affected
  • 12.2.0 to ≤ 12.2.7affected
  • 12.1.0 to ≤ 12.1.10affected
  • 12.0.0 to ≤ 12.0.10affected
  • 11.3.0 to ≤ 11.3.14affected

References