CVE-2019-14832: Incorrect Authorization

May 24, 2022 (updated August 1, 2023)

A flaw was found in the Keycloak REST API before version 8.0.0 where it would permit user access from a realm the user was not configured. An authenticated attacker with knowledge of a user id could use this flaw to access unauthorized information or to carry out further attacks.

References

bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-14832
github.com/advisories/GHSA-8prc-58j4-m55q
github.com/keycloak/keycloak/commit/0b73685ccf3181115ae3936a578708630215ac23
nvd.nist.gov/vuln/detail/CVE-2019-14832

Code Behaviors & Features

Detect and mitigate CVE-2019-14832 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →