CVE-2026-45165
CVE-2026-45165 · Idira Secrets Manager (Self-Hosted): Improper Authorization in REST API
This page contains facts from public vulnerability sources. Check the original advisory before updating.
An authorization flaw in Idira Conjur version 13.9.0 allows an authenticated user with limited privileges to perform unauthorized actions on a policy branch. Under specific circumstances, an attacker could potentially leverage this to retrieve unauthorized secrets, alter administrative access controls on the branch or cause a denial of service (DoS). Idira Security Bulletin CA26-38.
CVSS 8.6 · High · EPSS 0.2% · Fix available
- Published
- Updated
Affected products and versions
idira secrets manager (self-hosted)
- Versions
- ≥ 13.9, < 13.9.1: Affected; ≥ 13.9.1: Not affected (custom)
Update to 13.9.1