{"id":"CVE-2026-111247","kind":"vulnerability","aliases":["CVE-2026-111247"],"related":[],"title":"Realm role resolution treats user names as roles, granting extra access","description":"When resolving security roles of a realm-authenticated caller, the caller's user name is also treated as a role name in addition to the roles assigned by the realm. An authenticated attacker who can obtain an account whose user name equals a role name, for example through self-registration, is granted that role wherever authorization is evaluated through the Jakarta Authorization policy. Users are recommended to upgrade to version 10.3.0 or 11.0.0-M2, which fix the issue.","summary":"When a realm-authenticated user is checked for roles, the user's own name is also counted as a role name alongside the realm's roles. An attacker who gets an account whose name matches a role name is granted that role wherever Jakarta Authorization policy is evaluated.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["jakarta-authorization","realm-authentication","runtime"],"not_affected_if":["no-role-named-users","no-self-registration"],"how_to_check":null,"fix":"- Upgrade to `10.3.0` or `11.0.0-M2`, the versions the source names as fixed; the sources do not name the product.","status":"open","published_at":"2026-11-10T16:17:15+00:00","first_seen_at":"2026-11-10T16:22:33+00:00","triaged_at":"2026-11-10T16:24:21+00:00","updated_at":"2026-11-10T16:24:21+00:00","category":"runtime","confidence":0.5,"triage":{"at":"2026-11-10T16:24:21Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade to `10.3.0` or `11.0.0-M2`, the versions the source names as fixed; the sources do not name the product.","reach":"network","title":"Realm role resolution treats user names as roles, granting extra access","impact":"medium","summary":"When a realm-authenticated user is checked for roles, the user's own name is also counted as a role name alongside the realm's roles. An attacker who gets an account whose name matches a role name is granted that role wherever Jakarta Authorization policy is evaluated.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["jakarta-authorization","realm-authentication"],"confidence":0.5,"fix_status":"available","needs_auth":"yes","worst_case":"Attacker gains roles matching their user name, reaching protected resources","analyst_note":"Identify the affected product from the NVD entry (https://nvd.nist.gov/vuln/detail/CVE-2026-111247) so the version ranges and how to check can be confirmed.","how_to_check":"unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["no-self-registration","no-role-named-users"],"who_is_affected":"Applications that authenticate users through a realm and rely on Jakarta Authorization role checks are exposed. The risk needs an account whose user name equals a role name, which self-registration can allow. The sources do not say which product or configuration this applies to, so the affected software must be identified first.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.001238,"input_tokens":4591,"output_tokens":1558,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-111247':14A,17A '-2026':13A,16A '10.3.0':146C '11.0.0':148C 'access':11A 'account':57B,112C 'addit':97C 'alongsid':47B 'also':41B,90C 'assign':101C 'attack':53B,107C 'authent':23B,29B,82C,106C 'author':20B,70B,131C,137C 'caller':83C,85C 'check':32B 'count':42B 'cve':12A,15A 'equal':116C 'evalu':73B,133C 'exampl':121C 'extra':10A 'fix':151C 'get':55B 'grant':9A,65B,127C 'issu':153C 'jakarta':19B,69B,136C 'jakarta-author':18B 'm2':149C 'match':60B 'name':6A,39B,46B,59B,63B,88C,95C,115C,119C 'obtain':110C 'polici':71B,138C 'realm':1A,22B,28B,49B,81C,104C 'realm-authent':21B,27B,80C 'recommend':141C 'registr':125C 'resolut':3A 'resolv':75C 'role':2A,8A,34B,45B,51B,62B,67B,77C,94C,100C,118C,129C 'runtim':24B 'secur':76C 'self':124C 'self-registr':123C 'treat':4A,91C 'upgrad':143C 'user':5A,30B,36B,87C,114C,139C 'version':145C 'wherev':68B,130C 'whose':58B,113C","nicknames":[],"mitigations":[],"who_affected":"Applications that authenticate users through a realm and rely on Jakarta Authorization role checks are exposed. The risk needs an account whose user name equals a role name, which self-registration can allow. The sources do not say which product or configuration this applies to, so the affected software must be identified first.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["jakartaauthorization","realmauthentication","runtime","unknown"],"campaign_type":null,"search_a":"'-111247':14A,17A '-2026':13A,16A 'access':11A 'cve':12A,15A 'extra':10A 'grant':9A 'name':6A 'realm':1A 'resolut':3A 'role':2A,8A 'treat':4A 'user':5A","search_b":"'account':57B 'alongsid':47B 'also':41B 'attack':53B 'authent':23B,29B 'author':20B,70B 'check':32B 'count':42B 'evalu':73B 'get':55B 'grant':65B 'jakarta':19B,69B 'jakarta-author':18B 'match':60B 'name':39B,46B,59B,63B 'polici':71B 'realm':22B,28B,49B 'realm-authent':21B,27B 'role':34B,45B,51B,62B,67B 'runtim':24B 'user':30B,36B 'wherev':68B 'whose':58B","search_c":"'10.3.0':146C '11.0.0':148C 'account':112C 'addit':97C 'also':90C 'assign':101C 'attack':107C 'authent':82C,106C 'author':131C,137C 'caller':83C,85C 'equal':116C 'evalu':133C 'exampl':121C 'fix':151C 'grant':127C 'issu':153C 'jakarta':136C 'm2':149C 'name':88C,95C,115C,119C 'obtain':110C 'polici':138C 'realm':81C,104C 'realm-authent':80C 'recommend':141C 'registr':125C 'resolv':75C 'role':77C,94C,100C,118C,129C 'secur':76C 'self':124C 'self-registr':123C 'treat':91C 'upgrad':143C 'user':87C,114C,139C 'version':145C 'wherev':130C 'whose':113C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T16:17:15+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-111247","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111247","severity":null,"published_at":"2026-11-10T16:17:15+00:00","modified_at":"2026-11-10T16:17:15+00:00","first_seen_at":"2026-11-10T16:22:33+00:00","fetched_at":"2026-11-10T16:22:33+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}