This vulnerability (CWE-863) in PingFederate's role-based access control mechanism allows users with specific administrative roles to bypass intended permission boundaries and access expression testing features they should not have. The flaw affects versions from 11.3.0 up to and including 13.0.1. The CVSS 4.0 base score is 8.5, indicating a high severity with network attack vector, low attack complexity, no privileges required beyond certain administrative roles, and no user interaction needed. The vulnerability impacts confidentiality, integrity, and availability with high scope and impact metrics.

Users with certain administrative roles can perform unauthorized expression testing, potentially leading to unauthorized access or manipulation of administrative functions. This could compromise the security posture of the affected PingFederate deployments by allowing privilege escalation within the administrative interface.

No patch or official fix information is provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict administrative role assignments to trusted personnel and monitor for unusual administrative activity related to expression evaluation features.