A high-severity authorization bypass in HashiCorp Vault Enterprise allows authenticated users to perform unauthorized deletions of entity storage across namespace boundaries.

This is a missing authorization flaw (CWE-862) occurring within the identity entity batch-delete endpoint. An authenticated caller with permissions in one namespace can manipulate requests to delete critical identity data in separate, restricted namespaces.

Successful exploitation results in the permanent loss of identity storage, which can lead to significant service disruption and denial of service for dependent applications. Given the CVSS score of 8.2, this vulnerability poses a high risk to organizational data integrity and availability, potentially causing widespread operational impact if identity entities are purged.

Immediate Action: Update HashiCorp Vault Enterprise to version 2.0.4 or later to resolve the authorization logic flaw.

Proactive Monitoring: Review Vault access and audit logs for unusual batch-delete operations or unexpected administrative activity across namespace boundaries.

Compensating Controls: Restrict access to the identity entity batch-delete endpoint through granular Role-Based Access Control policies until patches are applied.

Public Exploit Available: false

The severity of this flaw necessitates immediate attention. Administrators must prioritize updating Vault Enterprise to the latest version to prevent unauthorized data loss and ensure that administrative actions remain confined to their intended scopes.