CVE-2025-23367 Org.wildfly.core:wildfly-server: wildfly improper rbac permission
Users with read-only roles can suspend or resume the WildFly server due to missing authorization checks in management handlers.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-23367?
CVE-2025-23367 is a medium-severity missing authorization vulnerability in Redhat Jboss Enterprise Application Platform, published on 30 Jan 2025. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
A flaw was found in the Wildfly Server Role Based Access Control (RBAC) provider. When authorization to control management operations is secured using the Role Based Access Control provider, a user without the required privileges can suspend or resume the server. A user with a Monitor or Auditor role is supposed to have only read access permissions and should not be able to suspend the server. The vulnerability is caused by the Suspend and Resume handlers not performing authorization checks to validate whether the current user has the required permissions to proceed with the action.
Weakness: CWE-284
Which versions are affected by CVE-2025-23367?
5 open source packages ship an affected version, including org.wildfly.core:wildfly-server and wildfly. It affects 2 products.
| Package | Affected | Fixed in |
|---|---|---|
org.wildfly.core:wildfly-server Maven | All versions | 27.0.1.Final |
org.wildfly.core:wildfly-server Maven | All versions | 27.0.1.Final |
org.wildfly.core:wildfly-server Maven | From 28.0.0.Beta1 | 28.0.0.Beta2 |
org.wildfly.core:wildfly-server Maven | From 28.0.0.Beta1 | 28.0.0.Beta2 |
wildfly Bitnami | All versions | 27.0.1, 31.0.1 |
Products include Redhat Jboss Enterprise Application Platform, Redhat Wildfly.
How do I fix CVE-2025-23367?
Upgrade org.wildfly.core:wildfly-server to a fixed version for your release line: 27.0.1.Final or 28.0.0.Beta2.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2025-23367 being exploited?
There is no known exploitation of CVE-2025-23367 in the wild and no public exploit code.
Other vulnerabilities in Redhat Jboss Enterprise Application Platform
- CVE-2017-12149 Red Hat JBoss Application Server Remote Code Execution
- CVE-2010-1428 Red Hat JBoss Information Disclosure
- CVE-2010-0738 Red Hat JBoss Authentication Bypass
- CVE-2016-3690 Deserialization in n/a
- CVE-2017-7504 Deserialization in JBoss
All Redhat Jboss Enterprise Application Platform vulnerabilities
Sources
Also known as BIT-wildfly-2025-23367, CLSA-2026-1780447845, GHSA-qr6x-62gq-4ccp.