Privilege escalation via stale administrative session

Privilege escalation in IBM Guardium Key Lifecycle Manager allows remote authenticated users to retain administrative access after demotion. A session-based race condition fails to revoke an already authenticated user's administrative session when the account is demoted. The attacker needs a low-privileged account and a session that previously held administrative rights; the retained session can read sensitive data, change configuration, or modify other users' permissions.