CVE-2026-20773 — Improper Authorization in PingFederate Administrative Expression Evaluation Endpoint

CVE-2026-20773

Improper Authorization in PingFederate Administrative Expression Evaluation Endpoint PUBLISHED

Description (CNA)

A role-based access control issue was identified in the administrative expression evaluation functionality. This could allow users with certain administrative roles to access expression testing capabilities beyond their intended permissions.

Affected (CNA)

Vendor / product	Versions
Ping Identity / PingFederate	affected 13.0.0 through 13.0.1; affected 12.3.0 through 12.3.5; affected 12.2.0 through 12.2.7; affected 12.1.0 through 12.1.10; affected 12.0.0 through 12.0.10; affected 11.3.0 through 11.3.14

CWE

CWE-863

References

https://support.pingidentity.com/s/article/SECADV054-Improper-Authorization-in-PingFederate-Administrative-Expression-Evaluation-Endpoint

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.