CVE-2026-86830
Received Received - Intake

Privilege Escalation in AWS IAM Identity Center TEAM

Publication date: 2026-09-14

Last updated on: 2026-09-14

Assigner: AMZN

Description
Incorrect privilege assignment in Temporary Elevated Access Management (TEAM) for AWS IAM Identity Center solution before version 1.5.1 might allow an authenticated remote user with application-level access to read, approve, modify, or revoke arbitrary access requests, thereby obtaining unintended temporary elevated access to the AWS accounts accessed using the TEAM deployment. This issue has been addressed in TEAM version 1.5.1 or later. We recommend upgrading to the latest version and ensuring any forked or derivative code is patched to incorporate the new fixes.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-14
Last Modified
2026-09-14
Generated
2026-09-14
AI Q&A
2026-09-14
EPSS Evaluated
N/A
NVD
CVE-2026-86830
EUVD
EUVD-2026-77769

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
aws temporary_elevated_access_management 1.5.1

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-266 A product incorrectly assigns a privilege to a particular actor, creating an unintended sphere of control for that actor.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability involves incorrect privilege assignment in the Temporary Elevated Access Management (TEAM) for AWS IAM Identity Center solution before version 1.5.1. An authenticated remote user with application-level access could exploit this to read, approve, modify, or revoke arbitrary access requests, gaining unintended temporary elevated access to AWS accounts.

Impact Analysis

An attacker could exploit this to gain elevated access to your AWS accounts, potentially leading to unauthorized data access, modification, or deletion. This could compromise sensitive information or disrupt services.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating compliance requirements for GDPR, HIPAA, and other regulations. It may result in data breaches, unauthorized disclosures, or failure to meet security controls.

Mitigation Strategies

Upgrade to TEAM version 1.5.1 or later to address the incorrect privilege assignment issue. Review and update any forked or derivative code to ensure it includes the latest fixes.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-86830. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart