CVE-2026-45165 — Idira Secrets Manager (Self-Hosted): Improper Authorization in REST API
An authorization flaw in Idira Conjur version 13.9.0 allows an authenticated user with limited privileges to perform unauthorized actions on a policy branch. Under specific circ…
Published: 2026-10-15 · CVSS: 8.6 · CVSS 4.0
An authorization flaw in Idira Conjur version 13.9.0 allows an authenticated user with limited privileges to perform unauthorized actions on a policy branch. Under specific circumstances, an attacker could potentially leverage this to retrieve unauthorized secrets, alter administrative access controls on the branch or cause a denial of service (DoS). Idira Security Bulletin CA26-38.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7