Depends what kind of assessment you want to do. Maybe you should change your title to indicate "Black Box" or "White Box" or both. I've learned that vendors have a very loose definition of "security review" on their software so it is important to do your own assessment if you have the resources.
The Vendor's code is theirs and you aren't allowed to decompile it without their permission. Most vendors are not willing to share their source code. All you can do is ask them for their report of their own internal source code review.
Static Application Assessment
There are ways to do security assessments without their decompiled code. Static code analysis like with Veracode is done on compiled code and the service never sees the source code. It helps triage the results if you can see the source code, though. Most often, I pass these results on to the vendor.
The best situation is if security assessments (static or dynamic) are written into the contract with the vendor, but it is legal to upload a compiled program to such a service.
Dynamic Web Application Assessment
A dynamic (black box) scan is totally allowed on an application in your environment and this should be your first step.