CVE-2026-4938 is an incorrect authorization vulnerability (CWE-863) affecting IBM Verify Identity Access and IBM Security Verify Access products and their containerized versions. Specifically, versions 11.0 through 11.0.2 and 10.0 through 10.0.9.1 are impacted. The flaw permits attackers who have only read-only privileges to escalate their capabilities and make unauthorized changes and deployments outside their permitted scope. The vulnerability is network exploitable with low attack complexity and requires low privileges but no user interaction. The impact is high on integrity but does not affect confidentiality or availability. No vendor advisory or patch information is currently available.

An attacker with read-only privileges can bypass authorization controls to make unauthorized modifications and deployments, potentially compromising the integrity of the affected systems. Confidentiality and availability are not impacted according to the CVSS vector. This could lead to unauthorized changes in identity access configurations or deployments, undermining trust in the system's access controls.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict read-only privileges to trusted users only and monitor for unusual modification or deployment activities. Follow IBM's security advisories for updates on patches or mitigations.