Skip to content
VMwareCVE-2026-47839

VMware UAA: improper access control

Critical9.2CVE-2026-47839 · Published Sep 11, 2026 · updated Sep 18, 2026

A vulnerability allows users authenticating through a federated OIDC provider to obtain the uaa.admin scope despite operators restricting that provider through externalGroupsWhitelist configuration. The issue occurs specifically when an OIDC identity provider uses groupMappingMode: AS_SCOPES with a wildcard externalGroupsWhitelist entry.

VMware advisory

Affected versions

PackageAffectedFixed in
UAA
Product
<= 77.30.0No fix yet
cf-deployment
Product
<= 48.9.0No fix yet
Details and references
CVSS 4.0
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Severity from
the vendor (its own CVE record or advisory)
Weakness
CWE-284

More VMware advisories

All VMware
Advisory
VMware sealed-secrets: observable discrepancy
Medium4.2Sep 15
VMware bosh-vsphere-cpi-release: improper certificate validation
High7.7Aug 29
VMware Spring AMQP: resource leak
Medium6.5Aug 27
VMware Spring Integration: race condition
Medium4.2Aug 27
VMware Spring Integration: improper input validation
Medium6.3Aug 27
VMware Spring Integration: race condition
High8.2Aug 27

Critical advisories by email

Wednesdays: the week’s critical and high advisories in the AI and data stack, with the fixed versions. Only in weeks that have some.

Double opt-in. Unsubscribe any time.