CVE-2020-10660: 
HashiCorp Vault vulnerability analysis and mitigation

HashiCorp Vault and Vault Enterprise versions 0.9.0 through 1.3.3 may, under certain circumstances, have an Entity's Group membership inadvertently include Groups the Entity no longer has permissions to. This vulnerability was assigned CVE-2020-10660 and was fixed in version 1.3.4 (HashiCorp Changelog).

The vulnerability affects the Entity Group membership functionality in HashiCorp Vault. Under specific conditions, an Entity could retain membership in Groups even after the permissions to those Groups had been revoked. This created a potential security issue where users could maintain access to resources through Group memberships that should have been removed (NVD).

The vulnerability could lead to unauthorized access to resources through improperly maintained Group memberships. This could potentially allow users to retain access to sensitive data and systems even after their permissions should have been revoked (NVD).

The vulnerability was fixed in HashiCorp Vault version 1.3.4. Organizations running affected versions should upgrade to version 1.3.4 or later to address this security issue (HashiCorp Changelog).