Idira Secrets Manager SaaS Edge versions before 1.8 had an improper access‑control flaw in its internal authentication components. A remote attacker can craft a specific request that manipulates the internal validation step and bypasses identity verification, allowing the attacker to obtain an access token without proper authentication. The resulting token grants the attacker the same permissions as the targeted identity, enabling unauthorized data access or further lateral movement.

This vulnerability affects CyberArk Software’s Conjur Cloud (Edge Finding only) product, known as Idira Secrets Manager SaaS Edge, in all releases prior to version 1.8. Users running those releases are at risk if exposed to the public network.

The CVSS score of 9.1 indicates a high‑impact risk, and while the EPSS score is not published, the absence from CISA’s KEV list suggests no current widely‑publicized exploit activity. The likely attack vector is a remote, unauthenticated network request to the Edge service, where the crafted request reaches the internal authentication logic. If exploited, the attacker could impersonate any user or application that relies on the issued token, potentially compromising system integrity and confidentiality.