github_osv/GHSA-c9x9-xv66-xp3v
Improper privilege management in Keycloak
A flaw was found in Keycloak, where it would permit a user with a view-profile role to manage the resources in the new account console. This flaw allows a user with a view-profile role to access and modify data for which the user does not have adequate permission.
gitlab/maven/org.keycloak/keycloak-core/CVE-2020-14389
Improper Privilege Management
It was found that Keycloak would permit a user with only view-profile role to manage the resources in the new account console, allowing access and modification of data the user was not intended to have.
gitlab/maven/org.keycloak/keycloak-model-jpa/CVE-2020-14389
Improper Privilege Management
It was found that Keycloak would permit a user with only view-profile role to manage the resources in the new account console, allowing access and modification of data the user was not intended to have.
gitlab/maven/org.keycloak/keycloak-server-spi-private/CVE-2020-14389
Improper Privilege Management
It was found that Keycloak would permit a user with only view-profile role to manage the resources in the new account console, allowing access and modification of data the user was not intended to have.
gitlab/maven/org.keycloak/keycloak-services/CVE-2020-14389
Improper Privilege Management
It was found that Keycloak would permit a user with only view-profile role to manage the resources in the new account console, allowing access and modification of data the user was not intended to have.
gitlab/maven/org.keycloak/keycloak-wildfly-server-subsystem/CVE-2020-14389
Improper Privilege Management
It was found that Keycloak would permit a user with only view-profile role to manage the resources in the new account console, allowing access and modification of data the user was not intended to have.
gitlab/npm/keycloak-connect/CVE-2020-14389
Improper Privilege Management
It was found that Keycloak would permit a user with only view-profile role to manage the resources in the new account console, allowing access and modification of data the user was not intended to have.