CVE-2026-20773

Improper Authorization in PingFederate Administrative Expression Evaluation Endpoint

Published Sep 14, 2026 CVSS 4.0 · 8.5 High EPSS < 1% KEV · Not listed

Description

A role-based access control issue was identified in the administrative expression evaluation functionality. This could allow users with certain administrative roles to access expression testing capabilities beyond their intended permissions.

Analysis

Technical impact

The vulnerability is a role‑based access control flaw in PingFederate’s administrative expression evaluation endpoint. It permits users with certain administrative roles to invoke the expression evaluation feature beyond the permissions that are intended for those roles.

Affected Systems

Ping Identity PingFederate deployments that utilize the administrative expression evaluation endpoint. No specific product version is listed, so any installation that provides this functionality may be affected.

Risk and Exploitability

The CVSS score of 8.5 classifies the flaw as high severity. The EPSS score is reported as less than 1%, indicating a very low probability of exploitation. It is not listed in the CISA KEV catalog. The most likely attack vector involves an internal user who possesses an administrative role that should not have access to the expression evaluation endpoint.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Ping Identity

PingFederate

unaffected

Version	Status	Constraints
`13.0.0`	affected	≤ 13.0.1
`12.3.0`	affected	≤ 12.3.5
`12.2.0`	affected	≤ 12.2.7
`12.1.0`	affected	≤ 12.1.10
`12.0.0`	affected	≤ 12.0.10
`11.3.0`	affected	≤ 11.3.14

No data.

Vendor Product Versions

Ping Identity

Pingfederate

Version	Status	Scheme	Platform
`[13.0.0,13.0.1]`	affected	semver	—
`[12.3.0,12.3.5]`	affected	semver	—
`[12.2.0,12.2.7]`	affected	semver	—
`[12.1.0,12.1.10]`	affected	semver	—
`[12.0.0,12.0.10]`	affected	semver	—
`[11.3.0,11.3.14]`	affected	semver	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Verify if a patch or update from Ping Identity addresses the access control issue in the administrative expression evaluation endpoint.
Review role assignments and restrict expression evaluation privileges only to users who truly need them, removing or adjusting roles that grant unintended access.
Implement strict separation of roles so that no single role combines unrelated administrative capabilities; audit role configurations regularly.
Monitor logs for usage of the expression evaluation endpoint by users who should not have permission to access it.

Generated by OpenCVE AI on September 15, 2026 at 15:19 UTC.

Tracking

Advisories

No advisories available

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact High

Vulnerable System Integrity Impact None

Vulnerable System Availability Impact None

Subsequent System Confidentiality Impact High

Subsequent System Integrity Impact High

Subsequent System Availability Impact High

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.351% probability within 30 days)

Exploitation none

Automatable no

Technical Impact partial

References

Link	Providers
https://support.pingidentity.com/s/article/SECADV054-Improper-Authorization-in-PingFederate-Administrative-Expression-Evaluation-Endpoint

History

Sep 14, 2026 12:30 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Sep 14, 2026 11:45 AM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Ping Identity Ping Identity pingfederate
Vendors & Products		Ping Identity Ping Identity pingfederate

Sep 14, 2026 10:45 AM Description updated. Title updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		A role-based access control issue was identified in the administrative expression evaluation functionality. This could allow users with certain administrative roles to access expression testing capabilities beyond their intended permissions.
Title		Improper Authorization in PingFederate Administrative Expression Evaluation Endpoint
Weaknesses		CWE-863
References		https://support.pingidentity.com/s/article/SECADV054-Improper-Authorization-in-PingFederate-Administrative-Expression-Evaluation-Endpoint
Metrics		cvssV4_0 `{'score': 8.5, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:H/SA:H'}`