Mend.io Vulnerability Database

What is a CVE vulnerability ID? icon What is a WS vulnerability ID? icon What is an MSC vulnerability ID? icon
New vulnerability? Tell us about it!
icon

We found results for “”

CVE-2025-14777

Good to know:

icon

Date: December 16, 2025

A flaw was found in Keycloak. An IDOR (Broken Access Control) vulnerability exists in the admin API endpoints for authorization resource management, specifically in ResourceSetService and PermissionTicketService. The system checks authorization against the resourceServer (client) ID provided in the API request, but the backend database lookup and modification operations (findById, delete) only use the resourceId. This mismatch allows an authenticated attacker with fine-grained admin permissions for one client (e.g., Client A) to delete or update resources belonging to another client (Client B) within the same realm by supplying a valid resource ID.

Severity Score

Related Resources (4)

https://nvd.nist.gov/vuln/detail/CVE-2025-14777
https://bugzilla.redhat.com/show_bug.cgi?id=2422596
https://access.redhat.com/security/cve/CVE-2025-14777
https://www.mend.io/vulnerability-database/CVE-2025-14777

Severity Score

Weakness Type (CWE)

Authentication Bypass by Alternate Name

CWE-289

CVSS v3.1

Base Score:
Attack Vector (AV): NETWORK
Attack Complexity (AC): LOW
Privileges Required (PR): HIGH
User Interaction (UI): NONE
Scope (S): UNCHANGED
Confidentiality (C): LOW
Integrity (I): HIGH
Availability (A): LOW

Do you need more information?

Contact Us