The vulnerability is an incorrect authorization check in the AuthConfig validation and integration execution runtime that allows an authenticated user to elevate privileges and impersonate a service account in the same project. The attacker could then perform actions with the impersonated service account’s permissions, potentially affecting project resources and data.

Google Cloud: Application Integration services running any version earlier than 2026‑08‑27 are affected. The patch was released on 27 August 2026 and no customer action is required if the update has already been applied.

The CVSS score of 7.3 indicates high severity. Because the EPSS score is not available, the likelihood of exploitation is unknown, but the flaw requires authenticated access and is therefore limited to internal users or compromised accounts. The vulnerability is not listed in the CISA KEV catalog. The attack vector is inferred to be an authorized user capable of modifying integration configurations to obtain service‑account impersonation.