An unauthenticated path traversal vulnerability exists in a ClearPass Policy Manager API endpoint. If an attacker can supply crafted path components, they can cause the system to reference files outside the intended directory and influence authorization decisions. The result is that the attacker can be assigned an unintended role with higher privileges than originally intended. The weakness is a classic path traversal flaw that is leveraged to circumvent normal access control, allowing remote privilege escalation.

All Hewlett Packard Enterprise ClearPass Policy Manager deployments are affected, including all released versions released before the security patch noted in the HPE support document. The exact version impact list is not specified in the advisory, so any ClearPass installation that has the vulnerable API endpoint should be treated as at risk.

The CVSS score of 7.3 indicates moderate to high severity. Because the vulnerability is unauthenticated, a remote attacker can exploit it over the network via the API without needing any credentials. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, but the lack of authentication and the possibility of privilege escalation suggest it could be actively targeted. If exploited, the attacker can bypass normal authorization controls and receive an unintended role, potentially granting broader access to network resources.