950 matches found
ECHO-A8A9-016D-71E9
Bulletin has no description...
ECHO-22DD-A28D-46E5
Bulletin has no description...
ECHO-B20E-705A-6D36
Bulletin has no description...
ECHO-8DFE-8D64-34B3
Bulletin has no description...
ECHO-E40A-5517-9388
Bulletin has no description...
ECHO-B617-5268-3591
Bulletin has no description...
ECHO-5BD0-12F6-D009
Bulletin has no description...
ECHO-73AB-600D-62BE Caught by Cursor Bugbot review on PR #19827: the real vulnerability (GHSA-7xf9-4jfc-wgm4) is specific to Fine-Grained Admin Permissions V2's RealmPermissionsV2 treating manage-clients as equivalent to managing the special "admin-permissions" client, which then grants realm-wide admin power. RealmPermissionsV2 and the admin-permissions client concept do not exist in 25.0.6 — its older RealmPermissions.canManageAuthorizationDefault() has no per-ResourceServer parameter at all (it's a single, undifferentiated realm-wide check), so there is no "is this the special admin-permissions client" distinction for a narrow, upstream-faithful fix to attach to. An earlier patch here unconditionally removed MANAGE_CLIENTS from that check to close the described escalation, but that changes intended authorization behavior for every regular client's authorization management, not just a vulnerable path (upstream's real fix leaves the MANAGE_CLIENTS grant intact for non-admin-permissions clients) — reverted.
Bulletin has no description...
ECHO-7EDB-23C5-02EC
Bulletin has no description...
ECHO-7E4D-4229-7370
Bulletin has no description...
ECHO-C80E-9875-82A0
Bulletin has no description...
ECHO-A444-0F4D-8828
Bulletin has no description...
ECHO-556F-4BDD-4E2B
Bulletin has no description...
ECHO-C7A1-5B03-6077
Bulletin has no description...
ECHO-42CA-F2BF-6FC6
Bulletin has no description...
ECHO-98AB-D175-C089
Bulletin has no description...
ECHO-5F32-C3CE-3F5F
Bulletin has no description...
ECHO-530E-5606-6B51
Bulletin has no description...