Privilege escalation via over-permissioned access tokens

Incorrect access control in Keyfactor Command before 12.5.0 allows remote authenticated users to gain excessive privileges via access tokens. The Identity Providers component issues access tokens with permissions beyond the account's authorized role; Keyfactor has not disclosed the underlying claim or scope logic. A valid low-privilege account is required, and exploitation enables broad data access with limited modification and service-interruption effects.