{"id":"CVE-2026-79809","revision":"b32efeb197d2411da5bf380d57dd1304","records":[{"revision":"b32efeb197d2411da5bf380d57dd1304","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-79809","aliases":[],"title":"Unauthenticated Path Traversal in ClearPass Policy Manager API Endpoint Leads to Authorization Bypass","description":"An unauthenticated path traversal vulnerability exists in an API endpoint of ClearPass Policy Manager. Successful exploitation of this vulnerability allows an unauthenticated remote attacker to influence authorization decisions and be assigned an unintended role.","state":0,"publishedAt":"2026-10-06T19:17:12.017+00:00","modifiedAt":"2026-10-07T18:06:41.115+00:00","affected":[{"ecosystem":"Vendor product","name":"ClearPass Policy Manager (CPPM)","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"defaultStatus\": \"affected\",\n                    \"product\": \"ClearPass Policy Manager (CPPM)\",\n                    \"vendor\": \"Hewlett Packard Enterprise (HPE)\",\n                    \"versions\": [\n                        {\n                            \"lessThanOrEqual\": \"6.14.0\",\n                            \"status\": \"affected\",\n                            \"version\": \"6.14.0\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"lessThanOrEqual\": \"6.11.15\",\n                            \"status\": \"affected\",\n                            \"version\": \"6.11.0\",\n                            \"versionType\": \"semver\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","score":7.3,"severity":"HIGH"}],"references":["https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05158en_us&docLocale=en_US"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-79809","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-79809","identifiers":["CVE-2026-79809"]},"retained":false,"historicalAffected":[]}],"coverage":[]}