Eclipse Kura EUVD-2026-121409

Requires an authenticated identity on the Eclipse Kura REST interface holding the rest.configuration permission but NOT kura.admin; the flaw is that the Configuration REST API v2 (org.eclipse.kura.rest.configuration.provider) fails to restrict access to the UserAdmin persistence component configuration to kura.admin holders. Exploitation is limited to deployments running Kura 5.1.0 through 5.6.2 that expose the REST API and have provisioned at least one non-admin identity with the rest.configuration permission; an attacker with no valid credentials cannot exploit it. The impact is amplified where password hashes matter because they are stored as unsalted SHA-256 digests, enabling offline cracking once read. No user interaction is required.

This is a genuine high-priority authorization flaw (CWE-863) in Eclipse Kura's Configuration REST API v2, confirmed by the Eclipse Foundation's own GHSA advisory. The vendor CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H, score 8.6) indicates a network-reachable, low-complexity attack requiring an already-authenticated identity, with high impact to confidentiality, integrity, and availability of the vulnerable system and no scope change (SC/SI/SA:N). The decisive risk signals are intrinsic to the flaw rather than external telemetry: an identity holding only the rest.configuration permission (a non-admin grant) can read unsalted SHA-256 password hashes for every identity including administrators, and can modify identities, permission assignments, and restore configuration snapshots to reach full admin - a reliable privilege-escalation primitive. Note a discrepancy worth flagging: the vendor rated PR:H, yet the description states the attacker needs only the limited rest.configuration permission, which is closer to PR:L (basic/low privileges), so PR:H may overstate the required access and the realistic barrier is lower than the vector implies. No EPSS score, no CISA KEV listing, and no public exploit code were provided; the vuln.today decision label is 'this_week' (not act_now/emergency), consistent with a serious but not actively-exploited-at-scale issue. Unsalted SHA-256 hashes materially worsen the confidentiality impact because disclosed digests are cheap to crack offline. Overall: a real priority for anyone running affected Kura versions with multiple REST identities, not a high-CVSS-but-low-real-risk issue, though it is gated behind holding a valid non-admin REST credential.

An authenticated operator or integration account that was granted only the rest.configuration permission queries the Configuration REST API v2 for the UserAdmin persistence component, retrieves the unsalted SHA-256 password hashes of all identities including administrators, and cracks or directly reuses them. Alternatively, the same account modifies permission assignments or restores a prior configuration snapshot to grant itself kura.admin, achieving full administrative control. No public exploit code was identified, but the attack requires no special tooling beyond normal REST calls (AV:N/AC:L).