Moderate severity vulnerability that affects org.keycloak:keycloak-core

Also known as GHSA-778x-2mqv-w6xw

Published 8 y ago 2018-03-12 · modified 4 mo ago 2026-06-17 · JSON

CVSS

6.5

v3.0 · NVD

CISA KEV

not known exploited

EPSS

1.9%

percentile 80%

Public exploits

none known

Red Hat Keycloak before version 2.4.0 did not correctly check permissions when handling service account user deletion requests sent to the rest server. An attacker with service account authentication could use this flaw to bypass normal permissions and delete users in a separate realm.

Exploit prediction (EPSS)

1.90% probability of exploitation in the next 30 days, higher than 80% of all scored CVEs.

CVSS scores

Assigned by	Version	Score	Vector
NVD	3.0	6.5	`CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N`
NVD	2.0	5.5	`AV:N/AC:L/Au:S/C:N/I:P/A:P`

Affected packages

Ecosystem	Package	Affected	Fixed in
maven	`org.keycloak:keycloak-core`	<2.4.0	2.4.0

Affected products

Red Hat, Inc. Keycloak

Classification

Weakness

CWE-284 Improper Access Control
CWE-264 Permissions, Privileges, and Access Controls

References

rhn.redhat.com /errata/RHSA-2017-0876.html · vendor-advisory, x_refsource_REDHAT, x_transferred
securitytracker.com /id/1038180 · vdb-entry, x_refsource_SECTRACK, x_transferred
bugzilla.redhat.com /show_bug.cgi?id=1388988 · x_refsource_CONFIRM, x_transferred
securityfocus.com /bid/97392 · vdb-entry, x_refsource_BID, x_transferred
access.redhat.com /errata/RHSA-2017:0873 · vendor-advisory, x_refsource_REDHAT, x_transferred
access.redhat.com /errata/RHSA-2017:0872 · vendor-advisory, x_refsource_REDHAT, x_transferred
nvd.nist.gov /vuln/detail/CVE-2016-8629 · advisory
github.com /advisories/GHSA-778x-2mqv-w6xw · advisory

Sources

CVE List: CVE-2016-8629
GitHub Advisory: GHSA-778x-2mqv-w6xw
NVD: CVE-2016-8629

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.

Summary