{"id":"CVE-2026-112191","kind":"vulnerability","aliases":["CVE-2026-112191"],"related":[],"title":"Eclipse Kura: identity API lets low-privilege users grant themselves admin","description":"In Eclipse Kura versions 5.4.0 through 5.6.2, the Identity REST APIs (identity/v1, and identity/v2 since 5.5.0, provided by org.eclipse.kura.rest.identity.provider) do not check identity and permission management requests against the permissions of the requesting identity. An authenticated identity holding the rest.identity permission, but not kura.admin, can assign any permission to any identity, including kura.admin to itself. It can also change the password of, or delete, identities holding more privileges than its own, including administrators, and create or delete permissions. This allows escalation to full administrative privileges and can lock legitimate administrators out of the device. The issue is fixed in Eclipse Kura 5.6.3.","summary":"In Eclipse Kura 5.4.0 through 5.6.2, the Identity REST APIs do not check whether the caller may manage identities and permissions. An authenticated user holding only the rest.identity permission can grant itself kura.admin, reset or delete administrator accounts, and lock real administrators out of the device.","severity":"high","cvss":8.6,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["eclipse-kura","infrastructure","iot-gateway","rest-api","self-hosted"],"not_affected_if":["identity-provider-not-installed","version-outside-5.4.0-5.6.2"],"how_to_check":"- Check the installed Eclipse Kura version and whether it falls in `5.4.0` through `5.6.2`\n- Check whether the org.eclipse.kura.rest.identity.provider bundle is installed and the identity/v1 or identity/v2 REST APIs are reachable\n- Check which accounts hold the rest.identity permission","fix":"- Eclipse Kura: move to `5.6.3`","status":"open","published_at":"2026-11-10T16:17:16+00:00","first_seen_at":"2026-11-10T16:22:33+00:00","triaged_at":"2026-11-10T16:23:20+00:00","updated_at":"2026-11-10T16:23:20+00:00","category":"infrastructure","confidence":0.8,"triage":{"at":"2026-11-10T16:23:20Z","model":"claude-haiku-5-5","output":{"fix":"- Eclipse Kura: move to `5.6.3`","reach":"network","title":"Eclipse Kura: identity API lets low-privilege users grant themselves admin","impact":"high","summary":"In Eclipse Kura 5.4.0 through 5.6.2, the Identity REST APIs do not check whether the caller may manage identities and permissions. An authenticated user holding only the rest.identity permission can grant itself kura.admin, reset or delete administrator accounts, and lock real administrators out of the device.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["eclipse-kura","iot-gateway","rest-api","self-hosted"],"confidence":0.8,"fix_status":"available","needs_auth":"yes","worst_case":"low-privilege account becomes full administrator and locks out others","analyst_note":"","how_to_check":"- Check the installed Eclipse Kura version and whether it falls in `5.4.0` through `5.6.2`\n- Check whether the org.eclipse.kura.rest.identity.provider bundle is installed and the identity/v1 or identity/v2 REST APIs are reachable\n- Check which accounts hold the rest.identity permission","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["version-outside-5.4.0-5.6.2","identity-provider-not-installed"],"who_is_affected":"Deployments of Eclipse Kura 5.4.0 through 5.6.2 that expose the Identity REST APIs to users holding the rest.identity permission are exposed. Installs on older or newer releases, or where the REST identity provider is not used, are not in the stated range. Teams where only kura.admin accounts can reach the API face less risk but should still upgrade.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.00079,"input_tokens":4729,"output_tokens":635,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-112191':15A,18A '-2026':14A,17A '5.4.0':35B,82C '5.5.0':93C '5.6.2':37B,84C '5.6.3':179C 'account':69B 'admin':12A 'administr':68B,73B,150C,161C,167C 'allow':157C 'also':135C 'api':4A,28B,41B,88C 'assign':123C 'authent':54B,113C 'caller':47B 'chang':136C 'check':44B,99C 'creat':152C 'cve':13A,16A 'delet':67B,141C,154C 'devic':77B,171C 'eclips':1A,20B,33B,79C,177C 'eclipse-kura':19B 'escal':158C 'fix':175C 'full':160C 'gateway':25B 'grant':10A,62B 'hold':56B,115C,143C 'host':31B 'ident':3A,39B,50B,86C,100C,111C,114C,128C,142C 'identity/v1':89C 'identity/v2':91C 'includ':129C,149C 'infrastructur':22B 'iot':24B 'iot-gateway':23B 'issu':173C 'kura':2A,21B,34B,80C,178C 'kura.admin':64B,121C,130C 'legitim':166C 'let':5A 'lock':71B,165C 'low':7A 'low-privileg':6A 'manag':49B,103C 'may':48B 'org.eclipse.kura.rest.identity.provider':96C 'password':138C 'permiss':52B,60B,102C,107C,118C,125C,155C 'privileg':8A,145C,162C 'provid':94C 'real':72B 'request':104C,110C 'reset':65B 'rest':27B,40B,87C 'rest-api':26B 'rest.identity':59B,117C 'self':30B 'self-host':29B 'sinc':92C 'user':9A,55B 'version':81C 'whether':45B","nicknames":[],"mitigations":[],"who_affected":"Deployments of Eclipse Kura 5.4.0 through 5.6.2 that expose the Identity REST APIs to users holding the rest.identity permission are exposed. Installs on older or newer releases, or where the REST identity provider is not used, are not in the stated range. Teams where only kura.admin accounts can reach the API face less risk but should still upgrade.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["eclipsekura","high","infrastructure","iotgateway","restapi","selfhosted"],"campaign_type":null,"search_a":"'-112191':15A,18A '-2026':14A,17A 'admin':12A 'api':4A 'cve':13A,16A 'eclips':1A 'grant':10A 'ident':3A 'kura':2A 'let':5A 'low':7A 'low-privileg':6A 'privileg':8A 'user':9A","search_b":"'5.4.0':35B '5.6.2':37B 'account':69B 'administr':68B,73B 'api':28B,41B 'authent':54B 'caller':47B 'check':44B 'delet':67B 'devic':77B 'eclips':20B,33B 'eclipse-kura':19B 'gateway':25B 'grant':62B 'hold':56B 'host':31B 'ident':39B,50B 'infrastructur':22B 'iot':24B 'iot-gateway':23B 'kura':21B,34B 'kura.admin':64B 'lock':71B 'manag':49B 'may':48B 'permiss':52B,60B 'real':72B 'reset':65B 'rest':27B,40B 'rest-api':26B 'rest.identity':59B 'self':30B 'self-host':29B 'user':55B 'whether':45B","search_c":"'5.4.0':82C '5.5.0':93C '5.6.2':84C '5.6.3':179C 'administr':150C,161C,167C 'allow':157C 'also':135C 'api':88C 'assign':123C 'authent':113C 'chang':136C 'check':99C 'creat':152C 'delet':141C,154C 'devic':171C 'eclips':79C,177C 'escal':158C 'fix':175C 'full':160C 'hold':115C,143C 'ident':86C,100C,111C,114C,128C,142C 'identity/v1':89C 'identity/v2':91C 'includ':129C,149C 'issu':173C 'kura':80C,178C 'kura.admin':121C,130C 'legitim':166C 'lock':165C 'manag':103C 'org.eclipse.kura.rest.identity.provider':96C 'password':138C 'permiss':102C,107C,118C,125C,155C 'privileg':145C,162C 'provid':94C 'request':104C,110C 'rest':87C 'rest.identity':117C 'sinc':92C 'version':81C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T16:17:16+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"emo@eclipse.org","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-112191","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112191","severity":null,"published_at":"2026-11-10T16:17:16+00:00","modified_at":"2026-11-10T16:17:16+00:00","first_seen_at":"2026-11-10T16:22:33+00:00","fetched_at":"2026-11-10T16:22:33+00:00","note":null}],"documents":[{"id":116107,"url":"https://github.com/eclipse-kura/kura/security/advisories/GHSA-v8gf-9w4p-662w","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}