The vulnerability is an argument injection flaw that allows a remote authenticated user to execute unauthorized actions. The defect allows attackers to supply crafted arguments that bypass access control checks in IBM Verify Identity Access and IBM Security Verify Access, as identified by CWE-88, which indicates insufficient input validation of privileged parameters.

The flaw impacts IBM Verify Identity Access versions 11.0.0 through 11.0.3, as well as IBM Security Verify Access versions 10.0.0 through 10.0.9.2. Containerized editions of both products are also affected; the advisories list corresponding container images. Any unpatched deployment of these products is therefore vulnerable to exploitation by authenticated users.

The CVSS score of 8.8 classifies this as high severity. With no EPSS score available, the exploitation probability is uncertain, and the vulnerability is not listed in the CISA KEV catalog, indicating no confirmed widespread exploitation. The vulnerability requires a valid authenticated session, so risk applies only to users with access credentials, but for those users the ability to bypass authorization controls can have significant security repercussions.