---
id: "CVE-2026-112191"
page: "https://infrastack.ai/live/CVE-2026-112191"
kind: "vulnerability"
aliases: ["CVE-2026-112191"]
title: "Eclipse Kura: identity API lets low-privilege users grant themselves admin"
severity: "high"
cvss: 8.6
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: []
ecosystems: []
tags: ["eclipse-kura", "infrastructure", "iot-gateway", "rest-api", "self-hosted"]
not_affected_if: ["identity-provider-not-installed", "version-outside-5.4.0-5.6.2"]
published_at: "2026-11-10T16:17:16+00:00"
first_seen_at: "2026-11-10T16:22:33+00:00"
updated_at: "2026-11-10T16:23:20+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-112191", "first_seen_at": "2026-11-10T16:22:33+00:00"}]
exploit_sources: []
---

# Eclipse Kura: identity API lets low-privilege users grant themselves admin

Link for people: https://infrastack.ai/live/CVE-2026-112191 (this .md is for agents)

In Eclipse Kura 5.4.0 through 5.6.2, the Identity REST APIs do not check whether the caller may manage identities and permissions. An authenticated user holding only the rest.identity permission can grant itself kura.admin, reset or delete administrator accounts, and lock real administrators out of the device.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Eclipse Kura version and whether it falls in `5.4.0` through `5.6.2`
- Check whether the org.eclipse.kura.rest.identity.provider bundle is installed and the identity/v1 or identity/v2 REST APIs are reachable
- Check which accounts hold the rest.identity permission

## Fix

- Eclipse Kura: move to `5.6.3`

## Timeline

- 2026-11-10T16:22:33+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-112191

## Documents

- [advisory] Vendor advisory: github.com https://github.com/eclipse-kura/kura/security/advisories/GHSA-v8gf-9w4p-662w

## From the sources

In Eclipse Kura versions 5.4.0 through 5.6.2, the Identity REST APIs (identity/v1, and identity/v2 since 5.5.0, provided by org.eclipse.kura.rest.identity.provider) do not check identity and permission management requests against the permissions of the requesting identity. An authenticated identity holding the rest.identity permission, but not kura.admin, can assign any permission to any identity, including kura.admin to itself. It can also change the password of, or delete, identities holding more privileges than its own, including administrators, and create or delete permissions. This allows escalation to full administrative privileges and can lock legitimate administrators out of the device. The issue is fixed in Eclipse Kura 5.6.3.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_