Org.wildfly.core:wildfly-server: wildfly improper rbac permission

Vulnerability

Description A flaw in WildFly’s Role Based Access Control (RBAC) provider allows users assigned the Monitor or Auditor roles—which are intended to grant only read-only access—to suspend or resume the management server. The root cause is that the Suspend and Resume management operation handlers do not perform authorization checks to verify the current user has the required permissions before executing the action [1].

Exploitation

To exploit this vulnerability, an attacker must first have valid credentials for a WildFly user account that has been granted the Monitor or Auditor role. The attacker can then send a management operation request to suspend or resume the server, which the handler will process without verifying that the user has the necessary write-level authorization. No additional privileges or network position beyond access to the management interface are required [2].

Impact

A successful attack can lead to a denial-of-service condition, as an unauthorized user can suspend the WildFly server, making it unavailable to serve applications. Conversely, a user could resume a suspended server, possibly interfering with intended administrative controls. The confidentiality and integrity of the server are not directly compromised [3][4].

Mitigation

Red Hat has released security updates (RHSA-2025:3465, RHSA-2025:3989, RHSA-2025:3990, and RHSA-2025:4550) for various affected products, including Red Hat Enterprise Linux and Red Hat Single Sign-On. Administrators should apply the updates to ensure proper authorization checks are performed on the Suspend and Resume handlers. There are no known workarounds; upgrading to the fixed versions is the recommended course of action [1][2][3][4].