CVE-2026-45165: CWE-863 (Incorrect Authorization) in Palo Alto Networks Idira Secrets Manager (Self-Hosted)

This vulnerability (CWE-863) in Idira Conjur 13.9.0 involves incorrect authorization checks that permit authenticated users with limited privileges to bypass intended access controls on a policy branch. Exploitation may lead to unauthorized secret disclosure, administrative control alterations, or denial of service. The issue affects self-hosted deployments of Idira Secrets Manager versions >=13.9 and <13.9.1. No known exploits are reported in the wild. The vulnerability was publicly disclosed with a high CVSS 4.0 score of 8.6.

An attacker with valid limited user credentials can exploit this flaw to access secrets they should not be authorized to see, modify administrative access controls on policy branches, or cause denial of service. This compromises confidentiality, integrity, and availability of the affected system components.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch links are provided and no official fix is confirmed, users should monitor Palo Alto Networks advisories for updates. Until a fix is available, restrict access to trusted users and consider additional access controls to limit exposure.