<html><body><div style="font-family: arial, helvetica, sans-serif; font-size: 12pt; color: #000000"><div><div><div>Date: 2. 6. 2026</div>Severity: 9.0 (Critical)<br><div>Affected versions: All midPoint versions prior to 4.8.12, 4.9.7, 4.10.3</div><div>Fixed in versions: 4.8.12, 4.9.7, 4.10.3</div><br><div>Description</div><br><div>An authorized user with audit log access can exploit a bug that discloses session identifiers to escalate privileges to system administrator level.</div><br><div>Note: Audit log access is a high-privilege role in midPoint, as it grants visibility into all system events and sensitive operations.</div><br><div>This vulnerability requires:</div><div>- Attacker to have authorization for audit log access (high-privilege role)</div><div>- Administrator to be currently logged in</div><div>- Administrator to have performed an audited action</div><div>- Attacker to capture and reuse the session identifier</div><br><div>Severity and Impact</div><br><div>This is Critical Severity Issue.</div><div>The authorized user may be able to escalate privileges to administrator-level access, which grants them unrestricted access to the MidPoint.</div><br><div>Mitigation</div><br><div>Users of affected midPoint versions are advised to upgrade to the latest maintenance releases: 4.8.12, 4.9.7, or 4.10.3.</div><br><div>If immediate upgrade is not possible:</div><br><div>1. Restrict Audit Log Access - Audit log access is a high-privilege role that should only be assigned to administrators</div><div>2. Review audit log viewer assignments - Ensure only trusted administrators have this authorization<br><br><span style="color: #000000; font-family: arial, helvetica, sans-serif; font-size: 16px; font-style: normal; font-variant-ligatures: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; orphans: 2; text-align: start; text-indent: 0px; text-transform: none; widows: 2; word-spacing: 0px; -webkit-text-stroke-width: 0px; white-space: normal; background-color: #ffffff; text-decoration-thickness: initial; text-decoration-style: initial; text-decoration-color: initial; display: inline !important; float: none;" data-mce-style="color: #000000; font-family: arial, helvetica, sans-serif; font-size: 16px; font-style: normal; font-variant-ligatures: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; orphans: 2; text-align: start; text-indent: 0px; text-transform: none; widows: 2; word-spacing: 0px; -webkit-text-stroke-width: 0px; white-space: normal; background-color: #ffffff; text-decoration-thickness: initial; text-decoration-style: initial; text-decoration-color: initial; display: inline !important; float: none;">This advisory is also available at</span><span style="color: #000000; font-family: arial, helvetica, sans-serif; font-size: 16px; font-style: normal; font-variant-ligatures: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; orphans: 2; text-align: start; text-indent: 0px; text-transform: none; widows: 2; word-spacing: 0px; -webkit-text-stroke-width: 0px; white-space: normal; background-color: #ffffff; text-decoration-thickness: initial; text-decoration-style: initial; text-decoration-color: initial; display: inline !important; float: none;" data-mce-style="color: #000000; font-family: arial, helvetica, sans-serif; font-size: 16px; font-style: normal; font-variant-ligatures: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; orphans: 2; text-align: start; text-indent: 0px; text-transform: none; widows: 2; word-spacing: 0px; -webkit-text-stroke-width: 0px; white-space: normal; background-color: #ffffff; text-decoration-thickness: initial; text-decoration-style: initial; text-decoration-color: initial; display: inline !important; float: none;"><span> </span></span><a href="https://docs.evolveum.com/midpoint/security/advisories/027-privilage-escalation-via-audit-log/">https://docs.evolveum.com/midpoint/security/advisories/027-privilage-escalation-via-audit-log/</a></div><div><div style="clear: both;" data-mce-style="clear: both;"><br data-mce-bogus="1"></div>---<br>Anton Tkacik<br>Backend Technical Leader & Developer<br>Evolveum s.r.o.</div></div></div></div></body></html>