EUVD-2026-83919
GHSA-c24q-2g88-pp57
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Network REST API, low complexity, but requires an existing agent-group credential (PR:L); high confidentiality/integrity impact on CA issuance policy, no availability effect.
Primary rating from Vendor (redhat).
CVSS VectorNVD
Lifecycle Timeline
5DescriptionNVD
A flaw was found in pki-core. The v2 REST ACL filter selects a tie-breaking permission for colliding literal and wildcard ACL keys using lexicographic string comparison rather than specificity, causing a wildcard-mapped permission to override a more specific literal-mapped permission when both match. In the CA's profile-management REST API this allows a request to POST /v2/profiles/raw -- intended to require Administrator-level profiles.create permission -- to instead be authorized under the lower-privileged profiles.approve permission held by the default Certificate Manager Agents group. The highest threat from this vulnerability is to confidentiality and integrity of the certificate authority's issuance policy.
Articles & Coverage 1
AnalysisAI
An authorization flaw in the pki-core v2 REST ACL filter lets an authenticated member of the default Certificate Manager Agents group invoke profile-management operations reserved for Administrator-level accounts, so a request to POST /v2/profiles/raw that should require profiles.create is instead authorized under the lower-privileged profiles.approve permission. The root cause is that when a literal ACL key (profiles.create) and a wildcard ACL key (profiles.approve) both match, the filter picks the winner by lexicographic string comparison rather than by specificity, allowing the wildcard mapping to override the more specific literal one; CVSS 3.1 rates this 8.1 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N), with the highest threat to the confidentiality and integrity of the CA's issuance policy. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires an authenticated account that is a member of the CA's default Certificate Manager Agents group (holding profiles.approve). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuine, well-characterized authorization (CWE-863) flaw with a coherent CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N = 8.1) reported directly by Red Hat, the upstream vendor for pki-core/Dogtag. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | No vendor-released patch has been identified at time of analysis, so track Red Hat's advisory at https://access.redhat.com/security/cve/CVE-2026-80110 and Bugzilla https://bugzilla.redhat.com/show_bug.cgi?id=2523749 and apply the errata package for pki-core as soon as a fixed build is published for your Certificate System version and RHEL stream. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all pki-core v2 REST deployments and enumerate members of the default Certificate Manager Agents group; audit recent POST /v2/profiles/raw and other profile-management activity for unauthorized changes; remove unnecessary users from the Certificate Manager Agents group and enforce administrator-only access to profile-management endpoints at the reverse proxy or WAF where possible. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Oracle Java SE 7 Update 6 and earlier contains multiple sandbox bypass vulnerabilities via the ClassFinder and forName m
Remote code execution in IBM Sterling B2B Integrator, Sterling Integrator, and Tivoli Common Reporting allows unauthenti
Java Runtime Environment sandbox bypass via incorrect image channel verification in 2D component allows remote unauthent
Oracle Java SE JDK/JRE 7 and 6 Update 27 and earlier allows remote code execution with complete system compromise throug
JBoss Seam 2 in Red Hat JBoss EAP 4.3.0 fails to sanitize JBoss Expression Language inputs, allowing remote attackers to
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 update 4 and earlier, 6 up
Multiple vulnerabilities in Oracle Java 7 before Update 11 allow remote attackers to execute arbitrary code by (1) using
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 2 and earlier, 6 Up
The WLS Security component in Oracle WebLogic Server 10.3.6.0, 12.1.2.0, 12.1.3.0, and 12.2.1.0 allows remote attackers
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 7 and earlier allow
Remote unauthenticated attackers can execute arbitrary code on Adobe ColdFusion servers through Java deserialization fla
The ExceptionDelegator component in Apache Struts before 2.2.3.1 interprets parameter values as OGNL expressions during
Same weakness CWE-863 – Incorrect Authorization
View allShare
External POC / Exploit Code
Leaving vuln.today