CVE-2026-86830

Incorrect privilege assignment in Temporary Elevated Access Management (TEAM) for AWS IAM Identity Center

Published Sep 14, 2026 CVSS 4.0 · 8.6 High EPSS < 1% KEV · Not listed

Description

Incorrect privilege assignment in Temporary Elevated Access Management (TEAM) for AWS IAM Identity Center solution before version 1.5.1 might allow an authenticated remote user with application-level access to read, approve, modify, or revoke arbitrary access requests, thereby obtaining unintended temporary elevated access to the AWS accounts accessed using the TEAM deployment.

This issue has been addressed in TEAM version 1.5.1 or later. We recommend upgrading to the latest version and ensuring any forked or derivative code is patched to incorporate the new fixes.

Analysis

Technical impact

The vulnerability involves incorrect privilege assignment in the Temporary Elevated Access Management (TEAM) component of AWS IAM Identity Center. An authenticated remote user with application-level access can read, approve, modify, or revoke any access request, thereby gaining unintended temporary elevated permissions in the AWS accounts managed by TEAM. The weakness is a CWE‑266 flaw, allowing an authorized user to alter privilege levels beyond intended scopes.

Affected Systems

The issue affects the AWS IAM Identity Center TEAM solution prior to version 1.5.1. All releases before v1.5.1 are vulnerable. The affected product is specified by the CNA as AWS:iam-identity-center-team.

Risk and Exploitability

The CVSS score of 8.6 indicates high severity. The EPSS score of <1% suggests a low but not zero likelihood of exploitation, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is an authenticated remote user with application-level access, requiring no additional network or device compromise. Because the flaw permits arbitrary modification or revocation of access requests, an attacker could gain unauthorized data access or full control of targeted AWS accounts.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

AWS

iam-identity-center-team

unaffected

Version	Status	Constraints
`0`	affected	< 1.5.1

No data.

Vendor Product Versions

Aws

Iam-identity-center-team

Version	Status	Scheme	Platform
`[0,1.5.1)`	affected	generic	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade the IAM Identity Center TEAM component to version 1.5.1 or later, which includes the fix for privilege assignment.
If any forked or derivative code is in use, ensure it incorporates the same patch and update to the latest changes.
Audit existing application-level access permissions to confirm that only essential users have rights to manage access requests.

Generated by OpenCVE AI on October 22, 2026 at 23:48 UTC.

Tracking

Advisories

No advisories available

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required High

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact High

Vulnerable System Integrity Impact High

Vulnerable System Availability Impact High

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity Low

Privileges Required High

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.690% probability within 30 days)

Exploitation none

Automatable no

Technical Impact total

References

Link	Providers
https://aws.amazon.com/security/security-bulletins/2026-112-aws/
https://github.com/aws-samples/iam-identity-center-team/releases/tag/v1.5.1
https://github.com/aws-samples/iam-identity-center-team/security/advisories/GHSA-6x87-mjv8-mgvj

History

Oct 20, 2026 6:30 PM Weaknesses updated View changes

Type	Values Removed	Values Added
Weaknesses		CWE-1220

Sep 14, 2026 9:00 PM Description updated. Title updated. First appearance in the feed. Weaknesses updated. Affected versions updated. Affected vendors updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		Incorrect privilege assignment in Temporary Elevated Access Management (TEAM) for AWS IAM Identity Center solution before version 1.5.1 might allow an authenticated remote user with application-level access to read, approve, modify, or revoke arbitrary access requests, thereby obtaining unintended temporary elevated access to the AWS accounts accessed using the TEAM deployment. This issue has been addressed in TEAM version 1.5.1 or later. We recommend upgrading to the latest version and ensuring any forked or derivative code is patched to incorporate the new fixes.
Title		Incorrect privilege assignment in Temporary Elevated Access Management (TEAM) for AWS IAM Identity Center
First Time appeared		Aws Aws iam-identity-center-team
Weaknesses		CWE-266
CPEs		cpe:2.3:a:aws:iam-identity-center-team::::::::
Vendors & Products		Aws Aws iam-identity-center-team
References		https://aws.amazon.com/security/security-bulletins/2026-112-aws/ https://github.com/aws-samples/iam-identity-center-team/releases/tag/v1.5.1 https://github.com/aws-samples/iam-identity-center-team/security/advisories/GHSA-6x87-mjv8-mgvj
Metrics		cvssV3_1 `{'score': 7.2, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H'}` cvssV4_0 `{'score': 8.6, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N'}` ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`