Eclipse Kura CVE-2026-112191

Exploitation requires an authenticated Kura identity that already holds the rest.identity permission but lacks kura.admin; such an account can reach the Identity REST APIs (identity/v1 on all affected versions, and identity/v2 on 5.5.0 and later) provided by the org.eclipse.kura.rest.identity.provider bundle. Affected deployments are Eclipse Kura 5.4.0 through 5.6.2 where these Identity REST APIs are exposed and reachable by the attacker. The principal limiting factor is the PR:H prerequisite: the attacker cannot be anonymous and must have been granted the rest.identity permission, so risk is concentrated in environments that delegate identity management to non-admin operators or where such an operator credential is compromised. No user interaction is required (UI:N).

This is a genuine, high-priority privilege-escalation flaw rather than a CVSS-inflated paper risk. The supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:H/UI:N, VC:H/VI:H/VA:H) scores 8.6 and is internally consistent with the description: a network-reachable REST API, low attack complexity, no user interaction, but requiring pre-existing privileges (PR:H) - namely an authenticated identity already holding the rest.identity permission. The impact is severe because the flaw permits a non-admin operator to assign kura.admin to itself and to delete or reset the passwords of genuine administrators, yielding both full compromise and denial-of-administration (administrator lockout). Mitigating the urgency somewhat: exploitation is not open to anonymous attackers - the attacker must already possess a rest.identity-scoped account, so this is primarily an insider/compromised-operator or lateral-movement escalation rather than a mass-exploitable perimeter bug. No EPSS score is provided, the CVE is not listed in CISA KEV, and the only references are the vendor GHSA advisory and an Eclipse CVE-assignment work item - there is no public exploit code or exploitation telemetry. The vuln.today decision label is 'this_week', consistent with a serious-but-privilege-gated issue. Note one signal gap to verify: the input provides only a CVSS 4.0 vector (no 3.1 vector and no EPSS), so exploitation-probability modeling here is inferred from the mechanism, not from a numeric likelihood score.

A low-trust operator (or an attacker who has phished/compromised such an account) that legitimately holds the rest.identity permission on an Eclipse Kura gateway sends a crafted request to the identity/v1 or identity/v2 REST endpoint to grant itself the kura.admin permission. Because the API never checks the requester's own permissions against the requested change, the operator becomes a full administrator and can additionally delete or reset the passwords of the real administrators, locking them out. No public exploit code is identified at time of analysis; the attack is a straightforward authenticated API call requiring no special tooling.