CVE-2026-86830: CWE-266 Incorrect privilege assignment in AWS iam-identity-center-team

The vulnerability CVE-2026-86830 affects AWS iam-identity-center-team versions before 1.5.1. It is caused by incorrect privilege assignment in the Temporary Elevated Access Management (TEAM) component, which may allow an authenticated remote user with application-level access to manipulate access requests, including reading, approving, modifying, or revoking them. This flaw could result in unauthorized temporary elevated access to AWS accounts accessed via the TEAM deployment. AWS has addressed this issue in version 1.5.1, and users are advised to upgrade to this or later versions.

An authenticated user with application-level access could exploit this vulnerability to gain unintended temporary elevated privileges on AWS accounts managed by TEAM. This includes the ability to read, approve, modify, or revoke access requests, potentially leading to unauthorized access and control over AWS resources. The CVSS 3.1 score is 7.2 (high), reflecting the significant confidentiality, integrity, and availability impacts.

A patch is available and the issue is fixed in TEAM version 1.5.1 and later. Users should upgrade to version 1.5.1 or newer to remediate this vulnerability. Additionally, any forked or derivative codebases should be reviewed and patched accordingly to incorporate the fix. Since this is a cloud-hosted service component, AWS manages remediation for the cloud service, but customers using the TEAM solution should ensure they are running the patched version.