CVE-2026-11577

Rejected reason: The reported behavior does not constitute a privilege escalation. Exploitation requires the attacker to already possess the manage-realm administrative role within the realm-management client. By design, the manage-realm role is intended to be equivalent in administrative authority to realm-admin. A user with manage-realm already has full administrative control over the realm. Therefore, importing users with realm-admin role mappings through POST /admin/realms/{realm}/partialImport does not grant any additional privileges beyond those already held by the administrator and does not represent a security vulnerability.

Published

Jun 8, 2026

Last Modified

Jul 3, 2026

Status

Rejected

• CVE-2026-115751Agentfront mcp-from-openapi from 2.2.0 before 2.9.0 contains…3.7
• CVE-2026-115752Signal K Server from 2.28.0-beta.2 before 2.34.0 contains a …4.2
• CVE-2026-115754serialize-javascript from 7.0.1 before 7.1.3 contains a cros…4.7
• CVE-2026-115758SumatraPDF is a multi-format reader for Windows. In version …8.2
• CVE-2026-11576The security fix for CVE-2025-0728 in eclipse-threadx NetX D…7.5
• CVE-2026-115762draw.io is a configurable diagramming and whiteboarding appl…6.1
• CVE-2026-115770Pocket ID is an OIDC provider that allows users to authentic…9.6
• CVE-2026-115774Twisted is an event-based framework for internet application…4.9
• CVE-2026-115775Twisted is an event-based framework for internet application…8.7
• CVE-2026-115776Twisted is an event-based framework for internet application…7.5
• CVE-2026-115778Twisted is an event-based framework for internet application…7.5
• CVE-2026-115779Effect is a TypeScript framework that consists of several pa…6.3