Unauthorized Permission Escalation in Eclipse Kura by Eclipse

CVE-2026-112191

What is CVE-2026-112191?

In Eclipse Kura versions 5.4.0 through 5.6.2, a significant security flaw exists within the Identity REST APIs that fail to properly verify identity and permission management requests. An authenticated user with the rest.identity permission can assign any permissions, including administrative access, to themselves or alter the credentials of more privileged identities. This flaw enables unauthorized users to gain full administrative control, potentially locking out legitimate administrators and compromising device security. This vulnerability was rectified in Eclipse Kura version 5.6.3.

References