CVE-2026-20773— Improper Authorization in PingFederate Administrative Expression Evaluation Endpoint
Quick assessment
Affected
Ping Identity PingFederate
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
在管理端表达式评估功能中，发现了一个基于角色的访问控制（RBAC）问题。该漏洞可能允许拥有特定管理角色的用户访问超出其预期权限范围的表达式测试功能。
Possible ATT&CK Techniques 1 AI
T1078 · Valid Accounts
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-20773
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Improper Authorization in PingFederate Administrative Expression Evaluation Endpoint
Source: CVE Program / CVE List V5
Vulnerability Description
A role-based access control issue was identified in the administrative expression evaluation functionality. This could allow users with certain administrative roles to access expression testing capabilities beyond their intended permissions.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:H/SA:H
Source: CVE Program / CVE List V5
Vulnerability Type
授权机制不正确
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Ping Identity | PingFederate | 13.0.0 ~ 13.0.1 | - |
|
II. Public POCs for CVE-2026-20773
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-20773
请登录查看更多情报信息。
Other References for CVE-2026-20773 (1)
IV. Related Vulnerabilities
Same product: PingFederate
-
CVE-2025-32736
PingFederate Administrative Console CSRF weaknesses -
CVE-2025-26862
PingFederate unexpected browser flow initiation in redirectl -
CVE-2024-25573
Stored Cross-Site Scripting in Administrative Console Contex -
CVE-2025-22854
Possible thread exhaustion from processing http responses in -
CVE-2025-21085
PingFederate OAuth Grant attribute duplication may use exces
Same vendor: Ping Identity
-
CVE-2026-21391
Improper Claim Validation in PingAM OIDC Provider -
CVE-2025-32736
PingFederate Administrative Console CSRF weaknesses -
CVE-2026-20746
PingDirectory copying of virtual attributes leads to memory -
CVE-2025-20628
Insufficient granularity of access control for Remote Connec -
CVE-2025-27935
Authentication Bypass in OTP (One-time Passcode) IdP Adapter
Same weakness: CWE-863
-
CVE-2026-73236
Apache Syncope: Cross-Realm authorization bypass in delegate -
CVE-2026-73370
Apache Syncope: Cross-Realm boundaries reconciliation bypass -
CVE-2026-73579
Apache Syncope: Non-recursive Any search could skip Realms r -
CVE-2026-73668
Apache Syncope: Cross-realm disclosure of confidential ConnI -
CVE-2026-90934
EspoCRM before 10.0.4 Field-level Security Bypass via Attend
V. Comments for CVE-2026-20773
No comments yet