deardaniel/secdata-raw huggingface dataset:
GitHub Security Advisory: GHSA-fwxx-wv44-7qfg
Package: org.springframework.cloud:spring-cloud-gateway-server (MAVEN)
Severity: HIGH (CVSS 7.5)
CWE: CWE-917: Improper Neutralization of Special Elements used in an Expression Language Statement ('Expression Language Injection')
Vulnerable versions: >= 4.0.0, <= 4.1.9
Patched in: unpatched

Summary: Spring Cloud Gateway Server Webflux is vulnerable to Expression Language Injection

Details:
The following versions of Spring Cloud Gateway Server Webflux may be vulnerable to the ability to expose environment variables and system properties to attackers.

An application should be considered vulnerable when all the following are true:

  *  The application is using Spring Cloud Gateway Server Webflux (Spring Cloud Gateway Server WebMVC is not vulnerable).
  *  An admin or untrusted third party using Spring Expression Language (SpEL) to access environment variables or system properties via routes.
  *  An untrusted third party could create a route that uses SpEL to access environment variables or system properties if:  *  The Spring Cloud Gateway Server Webflux actuator web endpoint is enabled via management.endpoints.web.exposure.include=gateway and management.endpoint.gateway.enabled=trueor management.endpoint.gateway.access=unrestricte.
  *  The actuator endpoints are available to attackers.
  *  The actuator endpoints are unsecured.
GitHub Security Advisory: GHSA-fwxx-wv44-7qfg
Package: org.springframework.cloud:spring-cloud-gateway-server (MAVEN)
Severity: HIGH (CVSS 7.5)
CWE: CWE-917: Improper Neutralization of Special Elements used in an Expression Language Statement ('Expression Language Injection')
Vulnerable versions: >= 4.2.0, < 4.2.6
Patched in: 4.2.6

Summary: Spring Cloud Gateway Server Webflux is vulnerable to Expression Language Injection

Details:
The following versions of Spring Cloud Gateway Server Webflux may be vulnerable to the ability to expose environment variables and system properties to attackers.

An application should be considered vulnerable when all the following are true:

  *  The application is using Spring Cloud Gateway Server Webflux (Spring Cloud Gateway Server WebMVC is not vulnerable).
  *  An admin or untrusted third party using Spring Expression Language (SpEL) to access environment variables or system properties via routes.
  *  An untrusted third party could create a route that uses SpEL to access environment variables or system properties if:  *  The Spring Cloud Gateway Server Webflux actuator web endpoint is enabled via management.endpoints.web.exposure.include=gateway and management.endpoint.gateway.enabled=trueor management.endpoint.gateway.access=unrestricte.
  *  The actuator endpoints are available to attackers.
  *  The actuator endpoints are unsecured.
GitHub Security Advisory: GHSA-fwxx-wv44-7qfg
Package: org.springframework.cloud:spring-cloud-gateway-server (MAVEN)
Severity: HIGH (CVSS 7.5)
CWE: CWE-917: Improper Neutralization of Special Elements used in an Expression Language Statement ('Expression Language Injection')
Vulnerable versions: >= 4.3.0, < 4.3.2
Patched in: 4.3.2

Summary: Spring Cloud Gateway Server Webflux is vulnerable to Expression Language Injection

Details:
The following versions of Spring Cloud Gateway Server Webflux may be vulnerable to the ability to expose environment variables and system properties to attackers.

An application should be considered vulnerable when all the following are true:

  *  The application is using Spring Cloud Gateway Server Webflux (Spring Cloud Gateway Server WebMVC is not vulnerable).
  *  An admin or untrusted third party using Spring Expression Language (SpEL) to access environment variables or system properties via routes.
  *  An untrusted third party could create a route that uses SpEL to access environment variables or system properties if:  *  The Spring Cloud Gateway Server Webflux actuator web endpoint is enabled via management.endpoints.web.exposure.include=gateway and management.endpoint.gateway.enabled=trueor management.endpoint.gateway.access=unrestricte.
  *  The actuator endpoints are available to attackers.
  *  The actuator endpoints are unsecured.
GitHub Security Advisory: GHSA-r9wp-qq53-qvjx
Package: net.mingsoft:ms-mcms (MAVEN)
Severity: LOW (CVSS 4.7)
CWE: CWE-284: Improper Access Control
Vulnerable versions: <= 6.1.1
Patched in: unpatched

Summary: mingSoft MCMS does not properly restrict file uploads

Details:
A flaw has been found in mingSoft MCMS 6.1.1. The affected element is an unknown function of the file /ms/file/uploadTemplate.do of the component Template Archive Handler. Executing a manipulation of the argument File can lead to unrestricted upload. The attack can be launched remotely. The exploit has been published and may be used.
GitHub Security Advisory: GHSA-c5w7-m8wf-xc77
Package: org.apache.nifi:nifi-web-api (MAVEN)
Severity: HIGH (CVSS 0.0)
CWE: CWE-862: Missing Authorization
Vulnerable versions: >= 1.1.0, < 2.8.0
Patched in: 2.8.0

Summary: Apache NiFi: Missing Authorization of Restricted Permissions for Component Updates

Details:
Apache NiFi 1.1.0 through 2.7.2 are missing authorization when updating configuration properties on extension components that have specific Required Permissions based on the Restricted annotation. The Restricted annotation indicates additional privileges required to add the annotated component to the flow configuration, but framework authorization did not check restricted status when updating a component previously added. The missing authorization requires a more privileged user to add a restricted component to the flow configuration, but permits a less privileged user to make property configuration changes. Apache NiFi installations that do not implement different levels of authorization for Restricted components are not subject to this vulnerability because the framework enforces write permissions as the security boundary. Upgrading to Apache NiFi 2.8.0 is the recommended mitigation.
GitHub Security Advisory: GHSA-4hx9-48xh-5mxr
Package: org.keycloak:keycloak-ldap-federation (MAVEN)
Severity: MODERATE (CVSS 5.5)
CWE: CWE-502: Deserialization of Untrusted Data
Vulnerable versions: < 26.2.11
Patched in: 26.2.11

Summary: Keycloak LDAP User Federation provider enables admin-triggered untrusted Java deserialization

Details:
A flaw was found in the Keycloak LDAP User Federation provider. This vulnerability allows an authenticated realm administrator to trigger deserialization of untrusted Java objects via a malicious LDAP server configuration.

### Mitigation

Disable LDAP referrals in all LDAP user providers in all realms if projects cannot upgrade to the patched versions.
GitHub Security Advisory: GHSA-4hx9-48xh-5mxr
Package: org.keycloak:keycloak-ldap-federation (MAVEN)
Severity: MODERATE (CVSS 5.5)
CWE: CWE-502: Deserialization of Untrusted Data
Vulnerable versions: >= 26.3.0, < 26.4.6
Patched in: 26.4.6

Summary: Keycloak LDAP User Federation provider enables admin-triggered untrusted Java deserialization

Details:
A flaw was found in the Keycloak LDAP User Federation provider. This vulnerability allows an authenticated realm administrator to trigger deserialization of untrusted Java objects via a malicious LDAP server configuration.

### Mitigation

Disable LDAP referrals in all LDAP user providers in all realms if projects cannot upgrade to the patched versions.
GitHub Security Advisory: GHSA-895x-rfqp-jh5c
Package: org.keycloak:keycloak-services (MAVEN)
Severity: MODERATE (CVSS 5.4)
CWE: CWE-613: Insufficient Session Expiration
Vulnerable versions: < 26.2.3
Patched in: 26.2.3

Summary: Keycloak does not invalidate offline sessions when the offline_access scope is removed

Details:
A flaw was found in Keycloak. An offline session continues to be valid when the offline_access scope is removed from the client. The refresh token is accepted and you can continue to request new tokens for the session. As it can lead to a situation where an administrator removes the scope, and assumes that offline sessions are no longer available, but they are.
GitHub Security Advisory: GHSA-64w3-5q9m-68xf
Package: org.keycloak:keycloak-services (MAVEN)
Severity: MODERATE (CVSS 5.4)
CWE: CWE-613: Insufficient Session Expiration
Vulnerable versions: < 26.2.11
Patched in: 26.2.11

Summary: Keycloak does not invalidate sessions when "Remember Me" is disabled

Details:
A flaw was found in Keycloak. Keycloak does not immediately enforce the disabling of the "Remember Me" realm setting on existing user sessions. Sessions created while "Remember Me" was active retain their extended session lifetime until they expire, overriding the administrator's recent security configuration change. This is a logic flaw in session management increases the potential window for successful session hijacking or unauthorized long-term access persistence. The flaw lies in the session expiration logic relying on the session-local "remember-me" flag without validating the current realm-level configuration.
GitHub Security Advisory: GHSA-64w3-5q9m-68xf
Package: org.keycloak:keycloak-services (MAVEN)
Severity: MODERATE (CVSS 5.4)
CWE: CWE-613: Insufficient Session Expiration
Vulnerable versions: >= 26.3.0, < 26.4.1
Patched in: 26.4.1

Summary: Keycloak does not invalidate sessions when "Remember Me" is disabled

Details:
A flaw was found in Keycloak. Keycloak does not immediately enforce the disabling of the "Remember Me" realm setting on existing user sessions. Sessions created while "Remember Me" was active retain their extended session lifetime until they expire, overriding the administrator's recent security configuration change. This is a logic flaw in session management increases the potential window for successful session hijacking or unauthorized long-term access persistence. The flaw lies in the session expiration logic relying on the session-local "remember-me" flag without validating the current realm-level configuration.
GitHub Security Advisory: GHSA-fm6w-rrp3-2x4w
Package: org.keycloak:keycloak-services (MAVEN)
Severity: MODERATE (CVSS 5.4)
CWE: CWE-266: Incorrect Privilege Assignment
Vulnerable versions: >= 26.3.0, < 26.4.9
Patched in: 26.4.9

Summary: Keycloak Affected by Broken Access Control Vulnerability in the UserManagedPermissionService

Details:
A flaw was found in Keycloak. A significant Broken Access Control vulnerability exists in the UserManagedPermissionService (UMA Protection API). When updating or deleting a UMA policy associated with multiple resources, the authorization check only verifies the caller's ownership against the first resource in the policy's list. This allows a user (Owner A) who owns one resource (RA) to update a shared policy and modify authorization rules for other resources (e.g., RB) in that same policy, even if those other resources are owned by a different user (Owner B). This constitutes a horizontal privilege escalation.
GitHub Security Advisory: GHSA-fm6w-rrp3-2x4w
Package: org.keycloak:keycloak-services (MAVEN)
Severity: MODERATE (CVSS 5.4)
CWE: CWE-266: Incorrect Privilege Assignment
Vulnerable versions: >= 26.5.0, < 26.5.3
Patched in: 26.5.3

Summary: Keycloak Affected by Broken Access Control Vulnerability in the UserManagedPermissionService

Details:
A flaw was found in Keycloak. A significant Broken Access Control vulnerability exists in the UserManagedPermissionService (UMA Protection API). When updating or deleting a UMA policy associated with multiple resources, the authorization check only verifies the caller's ownership against the first resource in the policy's list. This allows a user (Owner A) who owns one resource (RA) to update a shared policy and modify authorization rules for other resources (e.g., RB) in that same policy, even if those other resources are owned by a different user (Owner B). This constitutes a horizontal privilege escalation.
GitHub Security Advisory: GHSA-fm6w-rrp3-2x4w
Package: org.keycloak:keycloak-services (MAVEN)
Severity: MODERATE (CVSS 5.4)
CWE: CWE-266: Incorrect Privilege Assignment
Vulnerable versions: < 26.2.13
Patched in: 26.2.13

Summary: Keycloak Affected by Broken Access Control Vulnerability in the UserManagedPermissionService

Details:
A flaw was found in Keycloak. A significant Broken Access Control vulnerability exists in the UserManagedPermissionService (UMA Protection API). When updating or deleting a UMA policy associated with multiple resources, the authorization check only verifies the caller's ownership against the first resource in the policy's list. This allows a user (Owner A) who owns one resource (RA) to update a shared policy and modify authorization rules for other resources (e.g., RB) in that same policy, even if those other resources are owned by a different user (Owner B). This constitutes a horizontal privilege escalation.
GitHub Security Advisory: GHSA-g78x-7vwx-9f58
Package: org.keycloak:keycloak-services (MAVEN)
Severity: LOW (CVSS 2.7)
CWE: CWE-266: Incorrect Privilege Assignment
Vulnerable versions: < 26.4.9
Patched in: 26.4.9

Summary: Keycloak Admin API allows an administrator with limited privileges to retrieve sensitive custom attributes

Details:
A flaw was found in Keycloak Admin API. This vulnerability allows an administrator with limited privileges to retrieve sensitive custom attributes via the /unmanagedAttributes endpoint, bypassing User Profile visibility settings.
GitHub Security Advisory: GHSA-g78x-7vwx-9f58
Package: org.keycloak:keycloak-services (MAVEN)
Severity: LOW (CVSS 2.7)
CWE: CWE-266: Incorrect Privilege Assignment
Vulnerable versions: >= 26.5.0, < 26.5.2
Patched in: 26.5.2

Summary: Keycloak Admin API allows an administrator with limited privileges to retrieve sensitive custom attributes

Details:
A flaw was found in Keycloak Admin API. This vulnerability allows an administrator with limited privileges to retrieve sensitive custom attributes via the /unmanagedAttributes endpoint, bypassing User Profile visibility settings.
GitHub Security Advisory: GHSA-37gf-gmxv-74wv
Package: org.keycloak:keycloak-services (MAVEN)
Severity: HIGH (CVSS 8.8)
CWE: CWE-358: Improperly Implemented Security Check for Standard
Vulnerable versions: < 26.4.9
Patched in: 26.4.9

Summary: Keycloak fails to verify if an Identity Provider (IdP) is enabled before issuing tokens

Details:
A flaw was found in Keycloak. A vulnerability exists in the jwt-authorization-grant flow where the server fails to verify if an Identity Provider (IdP) is enabled before issuing tokens. The issuer lookup mechanism (lookupIdentityProviderFromIssuer) retrieves the IdP configuration but does not filter for isEnabled=false. If an administrator disables an IdP (e.g., due to a compromise or offboarding), an entity possessing that IdP's signing key can still generate valid JWT assertions that Keycloak accepts, resulting in the issuance of valid access tokens.
GitHub Security Advisory: GHSA-37gf-gmxv-74wv
Package: org.keycloak:keycloak-services (MAVEN)
Severity: HIGH (CVSS 8.8)
CWE: CWE-358: Improperly Implemented Security Check for Standard
Vulnerable versions: >= 26.5.0, < 26.5.3
Patched in: 26.5.3

Summary: Keycloak fails to verify if an Identity Provider (IdP) is enabled before issuing tokens

Details:
A flaw was found in Keycloak. A vulnerability exists in the jwt-authorization-grant flow where the server fails to verify if an Identity Provider (IdP) is enabled before issuing tokens. The issuer lookup mechanism (lookupIdentityProviderFromIssuer) retrieves the IdP configuration but does not filter for isEnabled=false. If an administrator disables an IdP (e.g., due to a compromise or offboarding), an entity possessing that IdP's signing key can still generate valid JWT assertions that Keycloak accepts, resulting in the issuance of valid access tokens.
GitHub Security Advisory: GHSA-qhp6-6p8p-2rqh
Package: org.wildfly.core:wildfly-elytron-integration (MAVEN)
Severity: HIGH (CVSS 8.1)
CWE: CWE-307: Improper Restriction of Excessive Authentication Attempts
Vulnerable versions: < 31.0.3.Final
Patched in: 31.0.3.Final

Summary: Wildfly Elytron integration susceptible to brute force attacks via CLI

Details:
### Impact

A flaw was found in Wildfly Elytron integration. The component does not implement sufficient measures to prevent multiple failed authentication attempts within a short time frame, making it more susceptible to brute force attacks via CLI.

### Patches

The default behaviour has been changed in WildFly Core 31.0.3.Final, and 32.0.0.Beta3 - the first version is used by WildFly 39.0.1.Final and the second will be included in WildFly 40.

### Workarounds

No direct workaround.
Monitoring network traffic / blocking suspicious traffic may help.

### References

https://www.cve.org/CVERecord?id=CVE-2025-23368
https://issues.redhat.com/browse/WFCORE-7192

### Acknowledgements

We would like to thank Claudia Bartolini (TIM S.p.A), Marco Ventura (TIM S.p.A), and Massimiliano Brolli (TIM S.p.A) for reporting this issue.
GitHub Security Advisory: GHSA-qhp6-6p8p-2rqh
Package: org.wildfly.core:wildfly-elytron-integration (MAVEN)
Severity: HIGH (CVSS 8.1)
CWE: CWE-307: Improper Restriction of Excessive Authentication Attempts
Vulnerable versions: >= 32.0.0.Beta1, < 32.0.0.Beta3
Patched in: 32.0.0.Beta3

Summary: Wildfly Elytron integration susceptible to brute force attacks via CLI

Details:
### Impact

A flaw was found in Wildfly Elytron integration. The component does not implement sufficient measures to prevent multiple failed authentication attempts within a short time frame, making it more susceptible to brute force attacks via CLI.

### Patches

The default behaviour has been changed in WildFly Core 31.0.3.Final, and 32.0.0.Beta3 - the first version is used by WildFly 39.0.1.Final and the second will be included in WildFly 40.

### Workarounds

No direct workaround.
Monitoring network traffic / blocking suspicious traffic may help.

### References

https://www.cve.org/CVERecord?id=CVE-2025-23368
https://issues.redhat.com/browse/WFCORE-7192

### Acknowledgements

We would like to thank Claudia Bartolini (TIM S.p.A), Marco Ventura (TIM S.p.A), and Massimiliano Brolli (TIM S.p.A) for reporting this issue.
GitHub Security Advisory: GHSA-hcvw-475w-8g7p
Package: org.keycloak:keycloak-services (MAVEN)
Severity: HIGH (CVSS 8.1)
CWE: CWE-347: Improper Verification of Cryptographic Signature
Vulnerable versions: >= 26.3.0, < 26.4.9
Patched in: 26.4.9

Summary: Keycloak affected by improper invitation token validation

Details:
A flaw was found in Keycloak. An attacker can exploit this vulnerability by modifying the organization ID and target email within a legitimate invitation token's JSON Web Token (JWT) payload. This lack of cryptographic signature verification allows the attacker to successfully self-register into an unauthorized organization, leading to unauthorized access.
GitHub Security Advisory: GHSA-hcvw-475w-8g7p
Package: org.keycloak:keycloak-services (MAVEN)
Severity: HIGH (CVSS 8.1)
CWE: CWE-347: Improper Verification of Cryptographic Signature
Vulnerable versions: < 26.2.13
Patched in: 26.2.13

Summary: Keycloak affected by improper invitation token validation

Details:
A flaw was found in Keycloak. An attacker can exploit this vulnerability by modifying the organization ID and target email within a legitimate invitation token's JSON Web Token (JWT) payload. This lack of cryptographic signature verification allows the attacker to successfully self-register into an unauthorized organization, leading to unauthorized access.
GitHub Security Advisory: GHSA-hcvw-475w-8g7p
Package: org.keycloak:keycloak-services (MAVEN)
Severity: HIGH (CVSS 8.1)
CWE: CWE-347: Improper Verification of Cryptographic Signature
Vulnerable versions: >= 26.5.0, < 26.5.3
Patched in: 26.5.3

Summary: Keycloak affected by improper invitation token validation

Details:
A flaw was found in Keycloak. An attacker can exploit this vulnerability by modifying the organization ID and target email within a legitimate invitation token's JSON Web Token (JWT) payload. This lack of cryptographic signature verification allows the attacker to successfully self-register into an unauthorized organization, leading to unauthorized access.
GitHub Security Advisory: GHSA-wv3h-x6c4-r867
Package: org.keycloak:keycloak-services (MAVEN)
Severity: MODERATE (CVSS 6.5)
CWE: CWE-863: Incorrect Authorization
Vulnerable versions: < 26.4.9
Patched in: 26.4.9

Summary: Keycloak services allows the issuance of access and refresh tokens for disabled users

Details:
A flaw was found in the keycloak-services component of Keycloak. This vulnerability allows the issuance of access and refresh tokens for disabled users, leading to unauthorized use of previously revoked privileges, via a business logic vulnerability in the Token Exchange implementation when a privileged client invokes the token exchange flow.
GitHub Security Advisory: GHSA-wv3h-x6c4-r867
Package: org.keycloak:keycloak-services (MAVEN)
Severity: MODERATE (CVSS 6.5)
CWE: CWE-863: Incorrect Authorization
Vulnerable versions: >= 26.5.0, < 26.5.2
Patched in: 26.5.2

Summary: Keycloak services allows the issuance of access and refresh tokens for disabled users

Details:
A flaw was found in the keycloak-services component of Keycloak. This vulnerability allows the issuance of access and refresh tokens for disabled users, leading to unauthorized use of previously revoked privileges, via a business logic vulnerability in the Token Exchange implementation when a privileged client invokes the token exchange flow.
GitHub Security Advisory: GHSA-r8w2-w357-9pjv
Package: fr.opensagres.xdocreport:fr.opensagres.xdocreport.template.freemarker (MAVEN)
Severity: CRITICAL (CVSS 9.8)
CWE: CWE-1336: Improper Neutralization of Special Elements Used in a Template Engine
Vulnerable versions: < 2.2.0
Patched in: 2.2.0

Summary: XDocReport affected by a Server-Side Template Injection (SSTI) vulnerability

Details:
A Server-Side Template Injection (SSTI) vulnerability in the FreeMarker component of opensagres XDocReport v1.0.0 to v2.1.0 allows attackers to execute arbitrary code via injecting crafted template expressions.
GitHub Security Advisory: GHSA-74rh-c5rh-88vg
Package: org.xwiki.platform:xwiki-platform-web (MAVEN)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-1021: Improper Restriction of Rendered UI Layers or Frames
Vulnerable versions: < 16.10.13
Patched in: 16.10.13

Summary: XWiki vulnerable to click-jacking through CSS injection in comments

Details:
### Impact

It's possible using comments to inject CSS that would transform the full wiki in a link area leading to a malicious page. All versions of XWiki are impacted by this kind of attack. 

### Patches

The problem has been patched not by preventing injecting CSS in comments, which is currently a feature of XWiki, but by requiring confirmation from users when driving them to untrusted domains after clicking on a link, thus preventing any click-jacking attack. 
This security measure has been put in place in XWiki 17.9.0, 17.4.6, 16.10.13.

### Workarounds

There's no out-of-the-box workaround, but it should be possible to partly reuse [the javascript code provided for the security measure](https://github.com/xwiki/xwiki-platform/blob/xwiki-platform-17.9.0/xwiki-platform-core/xwiki-platform-web/xwiki-platform-web-war/src/main/webapp/resources/uicomponents/link/link-protection.js) in a JSX object inside the wiki, to request the same kind of confirmation. 

### References
  * JIRA ticket: https://jira.xwiki.org/browse/XWIKI-23433
  * Documentation of the new security measure: https://www.xwiki.org/xwiki/bin/view/ReleaseNotes/Data/XWiki/17.9.0RC1/Entry006/
  * Commit for the security fix: https://github.com/xwiki/xwiki-platform/commit/29cb81f3a5387cf822d7e7534bdd63903275f86b

### For more information

If you have any questions or comments about this advisory:
* Open an issue in [Jira XWiki.org](https://jira.xwiki.org/)
* Email us at [Security Mailing List](mailto:security@xwiki.org)

### Attribution

Thanks Tomas Keech (Sentrium Security Ltd) for reporting this vulnerability.