---
id: "GHSA-6x87-mjv8-mgvj"
kind: "vulnerability"
aliases: ["GHSA-6x87-mjv8-mgvj"]
title: "CVE-2026-86830 - Incorrect privilege assignment in Temporary Elevated Access Management (TEAM) for AWS IAM Identity Center"
severity: "unknown"
cvss: null
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: []
ecosystems: []
tags: ["aws", "aws-accounts", "iam-identity-center", "infrastructure", "lab-disclosure", "self-hosted"]
not_affected_if: ["not-using-team"]
published_at: "2026-09-14T00:00:00+00:00"
first_seen_at: "2026-10-24T19:12:58+00:00"
updated_at: "2026-10-25T05:30:29+00:00"
sources: [{"source": "lab", "url": "https://aws.amazon.com/security/security-bulletins/rss/2026-112-aws/", "first_seen_at": "2026-10-24T19:12:58+00:00"}]
---

# CVE-2026-86830 - Incorrect privilege assignment in Temporary Elevated Access Management (TEAM) for AWS IAM Identity Center

TEAM is an open source AWS sample solution for managing temporary elevated access through IAM Identity Center. An authenticated user with application-level access can gain temporary elevated access to AWS accounts managed by TEAM that they should not have.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the deployed TEAM version; the sources say versions below `1.5.1` are impacted.
- Check whether any forked or derivative TEAM code is in use and whether it includes the fix.

## Fix

- Upgrade TEAM to `1.5.1` or later.
- Patch any forked or derivative code to incorporate the fix.

## Timeline

- 2026-10-24T19:12:58+00:00 lab https://aws.amazon.com/security/security-bulletins/rss/2026-112-aws/ — AWS: CVE-2026-86830 - Incorrect privilege assignment in Temporary Elevated Access Management (TEAM) for AWS IAM Identity Center

## Documents

- [advisory] AWS: CVE-2026-86830 - Incorrect privilege assignment in Temporary Elevated Access Management (TEAM) for AWS IAM Identity Center https://aws.amazon.com/security/security-bulletins/rss/2026-112-aws/

## From the sources

CVE-2026-86830 - Incorrect privilege assignment in Temporary Elevated Access Management (TEAM) for AWS IAM Identity Center

### CVE-2026-86830 - Incorrect privilege assignment in Temporary Elevated Access Management (TEAM) for AWS IAM Identity Center

Bulletin ID: 2026-112-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 09/14/2026 10:45 AM PDT

Description:

Temporary Elevated Access Management (TEAM) is an open source AWS sample solution for managing temporary elevated access via AWS IAM Identity Center. We identified CVE-2026-86830, where an authenticated user with application-level access could gain unintended temporary elevated access to AWS accounts managed by TEAM.

Impacted versions: <1.5.1

Resolution:

This issue has been addressed in TEAM version 1.5.1. We recommend upgrading to the latest version and ensuring any forked or derivative code is patched to incorporate the new fixes.

Workarounds:

None.

References:

- CVE-2026-86830
- GHSA-6x87-mjv8-mgvj

Acknowledgement:

We would like to thank Jani Muuriaisniemi at CUJO AI for collaborating on this issue through the coordinated vulnerability disclosure process.

 Please email aws-security@amazon.com with any security questions or concerns.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_