CVE-2026-13267

The CVSS 8.1 score on this horizontal privilege escalation warrants scrutiny. Standard horizontal escalation—attacker moves from one non-privileged user to another—typically lands in the 4-6 range. An 8.1 suggests either the affected user population includes accounts with elevated integrations, or the exploitation path is more accessible than the EPSS probability implies. Interrogate whether 'another user' could include service accounts, federation accounts, or LDAP sync accounts—if so, this is effectively a vertical escalation despite the language. The phrase 'specially crafted request' signals a missing authorization check rather than injection or cryptographic flaws. This maps to IDOR, insecure direct object reference, or context validation failures in the authorization layer. These are common in identity platforms where developers handle multiple user contexts, session states, and delegation relationships. The version span—10.x through containerized 11.x—matters because this is an architectural transition boundary where backward compatibility code accumulates. The vulnerability likely lives in shared authentication logic bridging both versions, particularly in session normalization, token migration, or credential federation bridging. Hybrid deployments sharing identity backends across versions create cross-version attack surface. Container deployments compound this: if the identity service runs with cluster-admin or namespace-admin bindings—which is common in container orchestration patterns—horizontal escalation at the application layer can detonate at the infrastructure layer. Map your deployment's service account permissions and cluster bindings to assess true blast radius. For immediate action: audit which code paths handle cross-version session logic, identify accounts with integration permissions beyond standard user personas, and treat this as a potential vertical escalation until proven otherwise. The EPSS probability suggests active reconnaissance interest.

Reviewed through automated stages and approved by a human before publication.