Issue
In Constellation-based applications, under certain conditions, authenticated users may be able to access portals that are not explicitly configured in their Access Group if those portals exist within the same application ruleset context, i.e. users with access to one portal can access other portals by modifying the URL, bypassing portal-based access restrictions.
This behavior is limited to portal-level navigation and does not provide direct access to unauthorized data. Data visibility and operations continue to be governed by configured security controls such as RBAC, ABAC, privileges, and case-type authorization. However, the product does not currently validate portal access against the list of portals configured in the user's Access Group, resulting in a gap in portal access enforcement.
Root cause
The current Constellation portal access validation logic verifies portal availability within the application and ruleset context but does not fully validate whether the requested portal is configured in the authenticated user's Access Group.
As a result, if a portal exists within the same application context, the portal may be loaded even when it is not explicitly associated with the user's configured Access Group. The issue is specific to portal-level validation and does not bypass underlying authorization controls configured on landing pages, views, cases, data access, or business operations.
Impact
-
Authenticated users may be able to load portals that are not explicitly configured in their Access Group when those portals are available within the same application context.
-
The behavior does not enable access to portals belonging to applications outside the active ruleset context.
-
Access to data and business functionality continues to depend on RBAC, ABAC, privileges, and case authorization configurations.
Affected configurations
-
Constellation-based applications containing multiple portals within the same application or ruleset stack.
-
Implementations where portal access restrictions are expected to be enforced solely through Access Group portal mappings.
-
Environments where landing pages, views, reports, or case types do not have sufficient server-side authorization controls configured.
Solution
A product fix is being implemented to strengthen portal access validation and ensure that portal loading validates both:
-
Application/ruleset context.
-
Portal configuration defined in the authenticated user's Access Group.
Until the fix becomes available, Pega recommends implementing the following mitigations:
1. Enforce RBAC and ABAC on Landing Pages and Views
-
Apply Role-Based Access Control (RBAC) and Attribute-Based Access Control (ABAC) to landing pages, views, and exposed functionality.
-
Configure appropriate privileges on landing pages and other resources so that only authorized users can access them.
-
Do not rely solely on portal visibility as a security control.
2. Configure Case-Type Security
-
Restrict case creation and case processing through case-type privileges and role-based authorization.
-
Ensure users can only create and access case types that align with their assigned business responsibilities.
-
Validate create-case permissions independently of portal access.
3. Review Security Hardening
-
Review Access Group configurations and portal assignments.
-
Verify privileges on landing pages, reports, and other sensitive resources.
-
Confirm through testing that users cannot access data or perform operations outside their intended authorization scope.
Recommended client action:
-
Review Constellation applications that contain multiple portals within the same application context.
-
Verify that all landing pages, views, APIs, reports, and case types are protected through appropriate RBAC, ABAC, and privilege configurations.
-
Validate that unauthorized users cannot access sensitive data or operations even if alternate portal URLs are accessed.
-
Plan to apply the forthcoming patch release once it becomes available for the applicable platform version.
References
RBAC (Role-Based Access Control)
Authorization Overview: Pegasystems Documentation
RBAC Documentation: Pegasystems Documentation
ABAC (Attribute-Based Access Control)
ABAC Documentation: Attribute-based access control
Creating Access Control Policies: Creating an access control policy
Access Control Policy Conditions: Attribute-Based Access Control (ABAC) Security Model