CVE-2026-20773: Improper Authorization in PingFederate Administrative Expression Evaluation Endpoint
A role-based access control issue was identified in the administrative expression evaluation functionality. This could allow users with certain administrative roles to access expression testing capabilities beyond their intended permissions.
Affected Software
Event History
Frequently Asked Questions
Who is realistically exposed to this issue?
PingFederate deployments in which users hold certain administrative roles are exposed to unauthorized access to expression-testing capabilities beyond those roles' intended permissions.
What access does an attacker need to exploit it?
The issue applies to users who already have certain administrative roles. The provided information does not indicate that unauthenticated or non-administrative users can exploit it.
How can I tell whether this affects my environment?
Review which users have administrative roles in PingFederate and whether they can access the administrative expression evaluation functionality beyond their intended permissions. The provided information does not identify affected product versions or a specific configuration prerequisite.