A flaw within the FlashArray Purity management interface allows an authenticated user with limited privileges to, under specific conditions, access functionality that exceeds their authorized scope. This under‑authorship bypass represents a privilege escalation vulnerability, potentially compromising the confidentiality, integrity, and availability of the storage array. The weakness aligns with CWE‑639, reflecting an insecure handling of permissions.

The vulnerability affects Everpure FlashArray appliances. No specific firmware or hardware revisions are listed in the CNA data, so all supported FlashArray models should be examined for the presence of the flaw until the vendor releases a documented fix.

The CVSS score of 8.6 reflects a high severity of the issue. No EPSS score is available, indicating lack of current exploitation probability data. The vulnerability is not listed in the CISA KEV catalog. Based on the description, the likely attack vector requires valid authenticated credentials of a low‑privileged account; the attacker must also satisfy the 'specific conditions' implied by the CWE‑639 entry but the concrete conditions are not detailed in the public advisory. The exploitation window therefore appears to be limited to systems with vulnerable firmware and mis‑configured user roles.