Role-Based Access Control Vulnerability in Wildfly Server

CVE-2025-23367

Summary

A vulnerability in the Wildfly Server's Role Based Access Control (RBAC) provider permits unauthorized users to execute critical management operations. Specifically, the flaw enables users with only Monitor or Auditor roles, who should be restricted to read-only access, to suspend or resume the server. This issue arises from inadequate authorization checks in the Suspend and Resume handlers, allowing actions without confirming appropriate user permissions. It's crucial for organizations to address this issue by applying the latest security patches provided by Red Hat.

References