# CVE-2026-112191: Eclipse Kura Identity REST APIs privilege escalation

Source: https://junglewise.ai/threats/cve-2026-112191-in-eclipse-kura-versions-5-4-0-through-5-6-2-the-identity-rest  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-10. Updated: 2026-11-10  
License: CC BY 4.0 with a link back

CVE-2026-112191 · Severity: info · Published 2026-11-10

Eclipse Kura is an IoT gateway framework that manages device identity and permissions through REST APIs. An attacker with a lower-privileged account can exploit missing authorization checks to escalate to full administrator privileges, lock out legitimate administrators, and gain complete control of the device.

Technologies: [Eclipse Kura](https://junglewise.ai/threats/technologies/eclipse-kura). Vendors: [Eclipse](https://junglewise.ai/threats/vendors/eclipse).

## Quick answers

**Is CVE-2026-112191 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-112191 being exploited in the wild.

**How severe is CVE-2026-112191?** Informational severity, published 10 November 2026.

**Which products and versions are affected?** Eclipse Kura 5.4.0 through 5.6.2.

**Is there a fix for CVE-2026-112191?** Yes: fixed in Eclipse Kura 5.6.3. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-112191 attacked?** It is attacked over the network, in a hosted service.

**Am I affected by CVE-2026-112191?** Check whether you run Eclipse Kura at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in Eclipse Kura 5.6.3

## Technical details

The Identity REST APIs (identity/v1 and identity/v2) in Eclipse Kura fail to validate that permission management requests are authorized by the requester's own permissions. An authenticated user with the rest.identity permission but without kura.admin can assign any permission (including kura.admin) to themselves or other identities, modify passwords, delete other identities, and manage permissions, leading to privilege escalation. The vulnerability is an authorization bypass due to improper privilege management checks.

## Affected products

- Eclipse Kura 5.4.0 through 5.6.2

## Timeline

- 2026-11-10: disclosed

## References

- [https://github.com/eclipse-kura/kura/security/advisories/GHSA-v8gf-9w4p-662w](https://github.com/eclipse-kura/kura/security/advisories/GHSA-v8gf-9w4p-662w)
- [https://gitlab.eclipse.org/security/cve-assignment/-/work_items/431](https://gitlab.eclipse.org/security/cve-assignment/-/work_items/431)

## Related threats

- [Eclipse Kura Web Console session exhaustion denial of service](https://junglewise.ai/threats/cve-2026-97891-in-eclipse-kura-version-5-0-0-to-5-6-2-the-web-console-allocates)
- [Eclipse Kura privilege escalation in CommandCloudApp ZIP extraction](https://junglewise.ai/threats/cve-2026-97401-in-kura-versions-5-6-2-commandcloudapp-execute-extracts-a-caller)
- [Eclipse Kura Service Listing V1 unauthenticated denial of service](https://junglewise.ai/threats/cve-2026-112186-in-eclipse-kura-versions-5-4-0-through-5-6-2-the-service-listing)
- [Eclipse Kura Configuration REST API authorization bypass](https://junglewise.ai/threats/cve-2026-112185-in-eclipse-kura-versions-5-1-0-through-5-6-2-the-configuration)
- [Eclipse Kura path traversal in command file-upload handler](https://junglewise.ai/threats/cve-2026-111729-in-kura-versions-5-6-2-the-command-file-upload-handler-at-post)