This vulnerability (CVE-2026-4938) involves incorrect authorization (CWE-863) in IBM Verify Identity Access and IBM Security Verify Access products, including their containerized versions. Specifically, users with read-only privileges can bypass intended access controls to make unauthorized changes and deployments outside their permission scope. The affected versions include IBM Verify Identity Access 11.0 through 11.0.2, IBM Security Verify Access 10.0 through 10.0.9.1, and their container equivalents. The CVSS 3.1 base score is 6.5, reflecting a medium severity with network attack vector, low attack complexity, and requiring low privileges but no user interaction. The vulnerability is published but no official fix or patch has been documented yet.

An attacker with read-only privileges can escalate their capabilities to perform unauthorized modifications and deployments, potentially compromising the integrity of the system configuration or deployed components. This could lead to unauthorized changes that impact system behavior or security posture. Confidentiality and availability impacts are not indicated. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict read-only user privileges to trusted personnel only and monitor for unusual modification or deployment activities. Follow IBM's official communications for updates on patches or mitigations.