CVE-2025-23367

A flaw was found in the Wildfly Server Role Based Access Control (RBAC) provider. When authorization to control management operations is secured using the Role Based Access Control provider, a user without the required privileges can suspend or resume the server. A user with a Monitor or Auditor role is supposed to have only read access permissions and should not be able to suspend the server. The vulnerability is caused by the Suspend and Resume handlers not performing authorization checks to validate whether the current user has the required permissions to proceed with the action.

Scoring

Severity

MEDIUM

CVSS base score

6.5

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

EPSS probability

0.68%

CWE

CWE-284

Published

2025-01-30

Last modified

2026-09-14

Affected products

• Red Hat Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8
• Red Hat Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8
• Red Hat Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9
• Red Hat Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9
• Red Hat Red Hat JBoss Enterprise Application Platform 7.4 on RHEL 7
• Red Hat Red Hat JBoss Enterprise Application Platform 7.4 on RHEL 7
• Red Hat Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8
• Red Hat Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9

Weakness type

• CWE-284

Related vulnerabilities

• CVE-2026-65182 — Apache Tomcat: Bypass longest prefix security constraint
• CVE-2026-76607 — Joomla Extension - fabrikar.com - Missing ACL check in download element in Fabrik < 4.7.2
• CVE-2026-54745 — Kubeflow Pipelines: Unauthenticated SSRF and HTTP smuggling in Kubeflow Pipelines frontend /_proxy/ route, bypasses ENABLE_AUTHZ=true
• CVE-2026-20315 — Cisco Secure Workload Software Security Hardening Release August 2026 - Improper Access Control Vulnerabilities
• CVE-2026-20192 — Cisco Identity Services Engine Hardening Release - Access Control Vulnerabilities
• CVE-2026-77553 — A malicious actor with access to the network and low privileges could exploit an Improper Access Control vulnerability f
• CVE-2026-77536 — A malicious actor with access to the network and low privileges could exploit an Improper Access Control vulnerability f
• CVE-2026-77534 — A malicious actor with access to the network and low privileges could exploit an Improper Access Control vulnerability f

Markdown version · Browse all CVEs