An incorrect authorization vulnerability in Esri Portal for ArcGIS fails to validate permissions assigned to developer credentials, allowing attackers to gain higher levels of access than intended. The flaw is a classic example of improper privilege management (CWE‑266). An attacker who compromises or abuses a developer credential can elevate privileges within the portal, increasing the risk of data exposure or service disruption.

Esri Portal for ArcGIS versions 11.4, 11.5, and 12.0 running on Windows, Linux, or Kubernetes are affected, regardless of deployment platform.

The CVSS score of 9.8 indicates a high severity vulnerability. While an EPSS score is not available, the lack of listing in the CISA KEV catalog suggests no known widespread exploitation yet, but the flaw remains exploitable under normal conditions. The likely attack vector involves misuse of developer credentials that bypass the portal’s permission checks, potentially enabling an attacker to gain full administrative control over the portal instance.