CVE-2026-4938

MediumCVSS 6.5/10Last modified Jul 30, 2026

Description

IBM Verify Identity Access 11.0 through 11.0.2 and IBM Security Verify Access 10.0 through 10.0.9.1 and IBM Verify Identity Access Container 11.0 through 11.0.2 and IBM Security Verify Access Container 10.0 through 10.0.9.1 could allow an attacker with read-only privileges to make unauthorized modifications and deployments outside of their assigned permissions.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Weakness enumeration

CWE-863

Affected software

No affected versions have been published.

Timeline

Published: Jul 17, 2026
Last modified: Jul 30, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-493806.1In JetBrains TeamCity before 2026.1 open redirect in the SAML plugin was possible CVE-2026-493814.8In JetBrains TeamCity before 2026.1 stored XSS on the SAML login page was possible CVE-2026-493827.8In JetBrains IntelliJ IDEA before 2026.1 code execution was possible via template injection in the Copyright plugin CVE-2026-493833.3In JetBrains IntelliJ IDEA before 2026.1 xXE in the UI Designer form parser was possible CVE-2026-493846.1In JetBrains PyCharm before 2025.3.4 stored XSS in Jupyter notebook Markdown cells was possible CVE-2026-493856.5In JetBrains YouTrack before 2026.1.13570 improper access control allowed low-privileged users to modify service accounts CVE-2026-493866.5In JetBrains YouTrack before 2026.1.13570 improper access control allowed enumeration of restricted issues and articles on Planning Canvas CVE-2026-493915.1Frappe is a full-stack web application framework. Prior to 16.19.0 and 15.109.0, Data Import does not escape imported column headers before CVE-2026-493925.3Wazuh is a free and open source platform used for threat prevention, detection, and response. From 4.6.0 until 4.14.6 and 5.0.0-beta3, DB::g CVE-2026-493947.1Frappe is a full-stack web application framework. Prior to 16.19.0, authorization bypass was possible via the update_page endpoint in Worksp CVE-2026-493967.1Nezha Monitoring is a self-hostable, lightweight, servers and websites monitoring and O&M tool. From version 1.0.0 to before version 2.0.14,CVE-2026-493975.3Nezha Monitoring is a self-hostable, lightweight, servers and websites monitoring and O&M tool. From version 2.0.0 to before version 2.0.14,