CVE-2026-112191

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-112191

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-112191.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-112191

Aliases

GHSA-v8gf-9w4p-662w

Published

2026-11-10T15:40:53Z

Modified

2026-11-11T02:48:51Z

Severity

8.6 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N CVSS Calculator

Summary

[none]

Details

In Eclipse Kura versions 5.4.0 through 5.6.2, the Identity REST APIs (identity/v1, and identity/v2 since 5.5.0, provided by org.eclipse.kura.rest.identity.provider) do not check identity and permission management requests against the permissions of the requesting identity. An authenticated identity holding the rest.identity permission, but not kura.admin, can assign any permission to any identity, including kura.admin to itself. It can also change the password of, or delete, identities holding more privileges than its own, including administrators, and create or delete permissions. This allows escalation to full administrative privileges and can lock legitimate administrators out of the device. The issue is fixed in Eclipse Kura 5.6.3.

Database specific

{
    "cna_assigner": "eclipse",
    "cwe_ids": [
        "CWE-269",
        "CWE-863"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/112xxx/CVE-2026-112191.json"
}

References

Affected packages

Git / github.com/eclipse-kura/kura

Affected ranges

Type

GIT

Repo

https://github.com/eclipse-kura/kura

Events

Introduced

d26bca6c654a3285447b21eb979f26e28584244b

Last Affected

42ecc87c4dca3e4e11d4181493506d822f92aa6f

Database specific

Show details

{
    "extracted_events": [
        {
            "range": [
                {
                    "introduced": "5.4.0"
                },
                {
                    "last_affected": "5.6.2"
                }
            ],
            "source": "AFFECTED_FIELD",
            "strategy": "StandardRange"
        }
    ]
}

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-112191.json"