1. Home
  2. CVE Database
  3. CVE-2026-4064
HIGH · 8.3

CVE-2026-4064

Missing authorization checks on multiple gRPC service endpoints in PowerShell Universal before 2026.1.4 allows an authenticated user with any valid token to bypass role-based access controls and perfo...

Vulnerability Description

Missing authorization checks on multiple gRPC service endpoints in PowerShell Universal before 2026.1.4 allows an authenticated user with any valid token to bypass role-based access controls and perform privileged operations — including reading sensitive data, creating or deleting resources, and disrupting service operations — via crafted gRPC requests.

CVSS Score

8.3

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
HIGH
Integrity
HIGH
Availability
LOW

Affected Products

VendorProductVersions
IronmansoftwarePowershell Universal< 2026.1.4

Related Weaknesses (CWE)

CWE-862

References

FAQ

What is CVE-2026-4064?

CVE-2026-4064 is a vulnerability with a CVSS score of 8.3 (HIGH). Missing authorization checks on multiple gRPC service endpoints in PowerShell Universal before 2026.1.4 allows an authenticated user with any valid token to bypass role-based access controls and perfo...

How severe is CVE-2026-4064?

CVE-2026-4064 has been rated HIGH with a CVSS base score of 8.3/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2026-4064?

Check the references section above for vendor advisories and patch information. Affected products include: Ironmansoftware Powershell Universal.