CVE-2026-13267

IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 and IBM Verify Identity Access Container 11.0 through 11.0.3 could allow an authenticated user to gain privileges of another user via a specially crafted request.

CVSS v3 8.1 HIGH

8.1^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.8 / Impact : 5.2

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://www.ibm.com/support/pages/node/7283079	Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:ibm:security_verify_access::::::::
	cpe:2.3:a:ibm:security_verify_access:10.0.9.2:interim_fix1::::::
	cpe:2.3:a:ibm:verify_identity_access::::::::
	cpe:2.3:a:ibm:verify_identity_access_container::::::::

History

14 Oct 2026, 22:10

Type	Values Removed	Values Added
Summary		(es) IBM Security Verify Access 10.0 hasta 10.0.9.2 y IBM Verify Identity Access 11.0 hasta 11.0.3 y IBM Verify Identity Access Contenedor 11.0 hasta 11.0.3 podría permitir a un usuario autenticado obtener privilegios de otro usuario mediante una solicitud especialmente diseñada.

Information

Published : 2026-08-12 20:17

Updated : 2026-10-14 22:10

NVD link : CVE-2026-13267

Mitre link : CVE-2026-13267

CVE.ORG link : CVE-2026-13267

JSON object : View

Products Affected

ibm

security_verify_access
verify_identity_access
verify_identity_access_container

CWE

CWE-302

Authentication Bypass by Assumed-Immutable Data

{"id": "CVE-2026-13267", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-13267", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-08-13T03:56:08.220516Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "psirt@us.ibm.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.1, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.2, "exploitabilityScore": 2.8}]}, "affected": [{"source": "psirt@us.ibm.com", "affectedData": [{"cpes": ["cpe:2.3:a:ibm:security_verify_access:10.0:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:security_verify_access:10.0.0:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:security_verify_access:10.0.9.2:*:*:*:*:*:*:*"], "vendor": "IBM", "product": "Security Verify Access", "versions": [{"status": "affected", "version": "10.0", "versionType": "semver", "lessThanOrEqual": "10.0.9.2"}]}, {"cpes": ["cpe:2.3:a:ibm:verify_identity_access:11.0:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:verify_identity_access:11.0.0:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:verify_identity_access:11.0.3:*:*:*:*:*:*:*"], "vendor": "IBM", "product": "Verify Identity Access", "versions": [{"status": "affected", "version": "11.0", "versionType": "semver", "lessThanOrEqual": "11.0.3"}]}, {"cpes": ["cpe:2.3:a:ibm:verify_identity_access_container:11.0:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:verify_identity_access_container:11.0.0:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:verify_identity_access_container:11.0.3:*:*:*:*:*:*:*"], "vendor": "IBM", "product": "Verify Identity Access Container", "versions": [{"status": "affected", "version": "11.0", "versionType": "semver", "lessThanOrEqual": "11.0.3"}]}, {"cpes": ["cpe:2.3:a:ibm:security_verify_access_container:10.0:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:security_verify_access_container:10.0.0:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:security_verify_access_container:10.0.9.2:*:*:*:*:*:*:*"], "vendor": "IBM", "product": "Security Verify Access Container", "versions": [{"status": "affected", "version": "10.0", "versionType": "semver", "lessThanOrEqual": "10.0.9.2"}]}]}], "published": "2026-08-12T20:17:34.690", "references": [{"url": "https://www.ibm.com/support/pages/node/7283079", "tags": ["Vendor Advisory"], "source": "psirt@us.ibm.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "psirt@us.ibm.com", "description": [{"lang": "en", "value": "CWE-302"}]}], "descriptions": [{"lang": "en", "value": "IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 and IBM Verify Identity Access Container 11.0 through 11.0.3 could allow an authenticated user to gain privileges of another user via a specially crafted request."}, {"lang": "es", "value": "IBM Security Verify Access 10.0 hasta 10.0.9.2 y IBM Verify Identity Access 11.0 hasta 11.0.3 y IBM Verify Identity Access Contenedor 11.0 hasta 11.0.3 podr\u00eda permitir a un usuario autenticado obtener privilegios de otro usuario mediante una solicitud especialmente dise\u00f1ada."}], "lastModified": "2026-10-14T22:10:00.210", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:ibm:security_verify_access:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "7B471197-37E5-4B7D-AF9E-0F9A3EEA4B6B", "versionEndIncluding": "10.0.9.2", "versionStartIncluding": "10.0.0"}, {"criteria": "cpe:2.3:a:ibm:security_verify_access:10.0.9.2:interim_fix1:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "D58DD2C2-F5CA-4A10-933B-4CB149CEB811"}, {"criteria": "cpe:2.3:a:ibm:verify_identity_access:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "5899B235-F061-4026-A0C1-AB506035D604", "versionEndIncluding": "11.0.3", "versionStartIncluding": "11.0"}, {"criteria": "cpe:2.3:a:ibm:verify_identity_access_container:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "A25819B9-7101-415B-93F8-27FB72BA5C3D", "versionEndIncluding": "11.0.3.0", "versionStartIncluding": "11.0.0.0"}], "operator": "OR"}]}], "sourceIdentifier": "psirt@us.ibm.com"}