CVE-2026-59335

Improper handling of case sensitivity CWE-178 in the identity zone authorization check in the Identity Zone Endpoint in Cloud Foundry UAA allows a remote authenticated attacker holding only the zones.write authority to bypass the intended restriction that this authority does not grant access to t...

CVE-2026-59335 Case-Sensitive Authorization Check Bypass via Identity Zone ID Case Manipulation Leads to Full UAA Compromise

Improper handling of case sensitivity CWE-178 in the identity zone authorization check in the Identity Zone Endpoint in Cloud Foundry UAA allows a remote authenticated attacker holding only the zones.write authority to bypass the intended restriction that this authority does not grant access to t...

CVE-2026-59335

Cloud Foundry UAA is affected by an authorization bypass (CWE-178) in its Identity Zone Endpoint . The root cause is a mismatch between the application's case-sensitive zone identifier comparison and MySQL's case-insensitive default collation: an attacker holding only zones.write can reference th...

EUVD-2026-65466

Improper handling of case sensitivity CWE-178 in the identity zone authorization check in the Identity Zone Endpoint in Cloud Foundry UAA allows a remote authenticated attacker holding only the zones.write authority to bypass the intended restriction that this authority does not grant access to t...

CVE-2025-22216 CVE-2025-22216 UAA Missing Zone Validation

A UAA configured with multiple identity zones, does not properly validate session information across those zones. A User authenticated against a corporate IDP can re-use their jsessionid to access other zones...

CVE-2019-11268

Cloud Foundry UAA version prior to 73.3.0, contain endpoints that contains improper escaping. An authenticated malicious user with basic read privileges for one identity zone can extend those reading privileges to all other identity zones and obtain private information on users, clients, and grou...

CVE-2019-11268 UAA SQL Identity Zone Vulnerability

Cloud Foundry UAA version prior to 73.3.0, contain endpoints that contains improper escaping. An authenticated malicious user with basic read privileges for one identity zone can extend those reading privileges to all other identity zones and obtain private information on users, clients, and grou...

CVE-2019-11268: UAA SQL Identity Zone Vulnerability | Cloud Foundry

Severity Medium Vendor Cloud Foundry Foundation Affected Cloud Foundry Products and Versions Severity is medium unless otherwise noted. UAA Release OSS is vulnerable prior to v73.3.0 Description UAA version prior to 73.3.0, contain endpoints that contains improper escaping. An authenticated...