An authentication and authorization flaw in HashiCorp Vault allows an authenticated user with a glob‑based policy on a kvv2 path to delete secrets they are not authorized to remove, which can cause downtime for the service. The vulnerability does not provide cross‑namespace deletion or allow reading of secret data; it is a denial‑of‑service scenario rooted in insufficient permission checks (CWE-288) and an authorization bypass through user‑controlled keys (CWE-639).

HashiCorp Vault Community Edition 2.0.0 and HashiCorp Vault Enterprise versions 2.0.0, 1.21.5, 1.20.10, and 1.19.16 are affected by this policy bypass. Users running these releases without updating are exposed to the described deletion issue.

The CVSS score of 8.1 indicates a high severity impact, and the EPSS score of <1% combined with a KEV absence suggests no known widespread exploitation yet, though the lack of delete permission restrictions makes the vulnerability readily exploitable in environments with misconfigured glob policies. The flaw stems from insufficient permission checks (CWE-288) and an authorization bypass through user‑controlled keys (CWE-639). An attacker must be authenticated and have policy access to the vulnerable path, but does not need any special administrative privileges beyond normal policy rights, increasing the likelihood of exploitation if privileges are misassigned.