38 matches found
EUVD-2025-210646
When internal roles are removed from a user within the WSO2 product, the system fails to invalidate any previously issued authentication tokens associated with that user. This vulnerability could allow users to retain their previous access privileges even after their roles have been revoked. As a...
CVE-2025-12317 Improper Token Revocation via SOAP Services in Multiple WSO2 Products Allows Retained Access Privileges
When internal roles are removed from a user within the WSO2 product, the system fails to invalidate any previously issued authentication tokens associated with that user. This vulnerability could allow users to retain their previous access privileges even after their roles have been revoked. As a...
CVE-2025-12317 Improper Token Revocation via SOAP Services in Multiple WSO2 Products Allows Retained Access Privileges
When internal roles are removed from a user within the WSO2 product, the system fails to invalidate any previously issued authentication tokens associated with that user. This vulnerability could allow users to retain their previous access privileges even after their roles have been revoked. As a...
PT-2026-68630
Name of the Vulnerable Software and Affected Versions WSO2 affected versions not specified Description The system fails to invalidate previously issued authentication tokens when internal roles are removed from a user. This allows users to maintain access privileges after their roles have been...
PYSEC-2026-831 OpenStack Identity Keystone Privilege Escalation vulnerability
The LDAP backend in OpenStack Identity Keystone Grizzly and Havana, when removing a role on a tenant for a user who does not have that role, adds the role to the user, which allows local users to gain privileges...
GHSA-6W3V-MCFH-M3Q7 Keycloak Admin UI REST Extensions: bulk role-removal endpoints fail to perform granular permission checks
A flaw was found in the admin-ui-ext component of Keycloak, which provides extended administrative user interface capabilities. The issue occurs because certain bulk role-removal endpoints fail to perform granular permission checks when deleting role mappings. This allows a delegated administrato...
EUVD-2026-36267
A flaw was found in the admin-ui-ext component of Keycloak, which provides extended administrative user interface capabilities. The issue occurs because certain bulk role-removal endpoints fail to perform granular permission checks when deleting role mappings. This allows a delegated administrato...
CVE-2026-11986
A flaw was found in the admin-ui-ext component of Keycloak, which provides extended administrative user interface capabilities. The issue occurs because certain bulk role-removal endpoints fail to perform granular permission checks when deleting role mappings. This allows a delegated administrato...
CVE-2026-11986
A flaw was found in the admin-ui-ext component of Keycloak, which provides extended administrative user interface capabilities. The issue occurs because certain bulk role-removal endpoints fail to perform granular permission checks when deleting role mappings. This allows a delegated administrato...
Direct Request ('Forced Browsing')
Overview Affected versions of this package are vulnerable to Direct Request 'Forced Browsing' due to missing granular authorization checks in the bulk role-mapping-delete endpoints POST /admin/realms/realm/ui-ext/role-mapping-delete/users/id and POST...
CVE-2026-11986: Direct Request
A flaw was found in the admin-ui-ext component of Keycloak, which provides extended administrative user interface capabilities. The issue occurs because certain bulk role-removal endpoints fail to perform granular permission checks when deleting role mappings. This allows a delegated administrato...
PT-2026-48695
Name of the Vulnerable Software and Affected Versions Keycloak affected versions not specified Description A flaw exists in the admin-ui-ext component, which extends the administrative user interface. The issue stems from a failure to perform granular permission checks within bulk role-removal...
PT-2026-80238
A flaw was found in the admin-ui-ext component of Keycloak, which provides extended administrative user interface capabilities. The issue occurs because certain bulk role-removal endpoints fail to perform granular permission checks when deleting role mappings. This allows a delegated administrato...
Keycloak security vulnerabilities
Keycloak is an open-source identity and access management solution developed by Keycloak. Keycloak has a security vulnerability, which stems from the fact that the endpoint for batch role removal does not perform fine-grained permission checks. This could allow with limited permissions to remove...
CVE-2026-41662
Admidio suffers a Missing Minimum Administrator Check in Role::stopMembership(), before 5.0.9. The code path removes a member from the administrator role without verifying that at least one admin remains; with two admins, sequential removals can leave zero admins, locking out administrative acces...
CVE-2025-10054
The CVE-2025-10054 entry concerns the ELEX WordPress HelpDesk & Customer Ticketing System plugin for WordPress. The vulnerability arises from a missing capability check in the eh_crm_remove_agent function across versions up to 3.3.1, enabling authenticated users with Subscriber-level access and a...
EUVD-2025-198489
The ELEX WordPress HelpDesk & Customer Ticketing System plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'ehcrmremoveagent' function in all versions up to, and including, 3.3.1. This makes it possible for authenticated attackers, wit...
CVE-2025-10054 ELEX WordPress HelpDesk & Customer Ticketing System <= 3.3.1 - Missing Authorization to Authenticated (Subscriber+) Role Removal
The ELEX WordPress HelpDesk & Customer Ticketing System plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'ehcrmremoveagent' function in all versions up to, and including, 3.3.1. This makes it possible for authenticated attackers, wit...
WordPress ELEX WordPress HelpDesk & Customer Ticketing System plugin <= 3.3.1 - Missing Authorization to Authenticated (Subscriber+) Role Removal vulnerability
Missing Authorization to Authenticated Subscriber+ Role Removal vulnerability discovered by Michelle Porter - Wordfence in WordPress Plugin ELEX WordPress HelpDesk & Customer Ticketing System versions = 3.3.1...
PT-2025-47728
Name of the Vulnerable Software and Affected Versions ELEX WordPress HelpDesk & Customer Ticketing System plugin versions through 3.3.1 Description The ELEX WordPress HelpDesk & Customer Ticketing System plugin for WordPress has a flaw that allows unauthorized data modification. A missing...