Role-Based Access Control Vulnerability in PingFederate by Ping Identity
CVE-2026-20773

8.5HIGH

Key Information:

Vendor

Ping Identity

Status
Pingfederate
Vendor
CVE Published:
14 September 2026

What is CVE-2026-20773?

A role-based access control issue exists within the administrative expression evaluation feature of PingFederate, which may allow users assigned specific administrative roles to perform expression testing outside of their intended permissions. This misconfiguration poses a security risk by potentially enabling unauthorized access to sensitive functionalities.

Affected Version(s)

PingFederate 13.0.0 <= 13.0.1

PingFederate 12.3.0 <= 12.3.5

PingFederate 12.2.0 <= 12.2.7

References

https://support.pingidentity.com/s/article/SECADV054-Impr...

CVSS V4

Score:
8.5
Severity:
HIGH
Confidentiality:
High
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.