CVE-2026-112191
In Eclipse Kura versions 5.4.0 through 5.6.2, the Identity REST APIs (identity/v1, and identity/v2 since 5.5.0, provided by org.eclipse.kura.rest.identity.provider) do not check identity and permission management requests against the permissions of the requesting identity. An authenticated identity holding the rest.identity permission, but not kura.admin, can assign any permission to any identity, including kura.admin to itself. It can also change the password of, or delete, identities holding more privileges than its own, including administrators, and create or delete permissions. This allows escalation to full administrative privileges and can lock legitimate administrators out of the device. The issue is fixed in Eclipse Kura 5.6.3.
| CWE | CWE-269 CWE-863 |
| Vendor | eclipse foundation |
| Product | eclipse kura |
| Published | Nov 10, 2026 |
Get instant alerts for eclipse foundation eclipse kura
Be the first to know when new unknown vulnerabilities affecting eclipse foundation eclipse kura are published — delivered to Slack, Telegram or Discord.