How severe is CVE-2025-14777?

CVE-2025-14777 has a CVSS 3.x base score of 6.0, rated medium severity. It is exploitable over network with low attack complexity, requires high privileges and no user interaction. Impact on confidentiality is low, integrity high, and availability low.

Is CVE-2025-14777 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (23rd percentile), an estimate of the probability of exploitation in the next 30 days.

How do I fix CVE-2025-14777?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.

Does CVE-2025-14777 have an EU (EUVD) identifier?

Yes. CVE-2025-14777 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2025-203501.

When was CVE-2025-14777 published?

CVE-2025-14777 was published on 2025-12-16 and last updated on 2026-06-17.

CVE-2025-14777

CVE-2025-14777 is a medium-severity vulnerability with a CVSS 3.x base score of 6.0. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-289.

Key facts

Severity: Medium (CVSS 3.x base score 6.0)
EPSS exploit prediction: 0% (23rd percentile)
Actively exploited: Not listed in CISA KEV
EU (EUVD) id: EUVD-2025-203501
Weakness: CWE-289
Published: 2025-12-16
Last modified: 2026-06-17

Description

A flaw was found in Keycloak. An IDOR (Broken Access Control) vulnerability exists in the admin API endpoints for authorization resource management, specifically in ResourceSetService and PermissionTicketService. The system checks authorization against the resourceServer (client) ID provided in the API request, but the backend database lookup and modification operations (findById, delete) only use the resourceId. This mismatch allows an authenticated attacker with fine-grained admin permissions for one client (e.g., Client A) to delete or update resources belonging to another client (Client B) within the same realm by supplying a valid resource ID.

Frequently asked questions

What is CVE-2025-14777?: A flaw was found in Keycloak. An IDOR (Broken Access Control) vulnerability exists in the admin API endpoints for authorization resource management, specifically in ResourceSetService and PermissionTicketService. The system checks authorization against the resourceServer (client) ID provided in the API request, but the backend database lookup and modification operations (findById, delete) only use the resourceId. This mismatch allows an authenticated attacker with fine-grained admin permissions for one client (e.g., Client A) to delete or update resources belonging to another client (Client B) within the same realm by supplying a valid resource ID.
How severe is CVE-2025-14777?: CVE-2025-14777 has a CVSS 3.x base score of 6.0, rated medium severity. It is exploitable over network with low attack complexity, requires high privileges and no user interaction. Impact on confidentiality is low, integrity high, and availability low.
Is CVE-2025-14777 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (23rd percentile), an estimate of the probability of exploitation in the next 30 days.
How do I fix CVE-2025-14777?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
Does CVE-2025-14777 have an EU (EUVD) identifier?: Yes. CVE-2025-14777 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2025-203501.
When was CVE-2025-14777 published?: CVE-2025-14777 was published on 2025-12-16 and last updated on 2026-06-17.

References

Other CWE-289 vulnerabilities

CVE-2026-9701 — Critical (CVSS 9.8): The Eventer plugin for WordPress is vulnerable to an insecure password reset mechanism in all versions up to, and…
CVE-2026-24058 — Critical (CVSS 9.8): Soft Serve is a self-hostable Git server for the command line. Versions 0.11.2 and below have a critical authentication…
CVE-2025-13613 — Critical (CVSS 9.8): The Elated Membership plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including,…
CVE-2024-56511 — Critical (CVSS 9.8): DataEase is an open source data visualization analysis tool. Prior to 2.10.4, there is a flaw in the authentication in…
CVE-2023-1803 — Critical (CVSS 9.8): Authentication Bypass by Alternate Name vulnerability in DTS Electronics Redline Router firmware allows Authentication…
CVE-2025-29266 — Critical (CVSS 9.6): Unraid 7.0.0 before 7.0.1 allows remote users to access the Unraid WebGUI and web console as root without…

Browse all CWE-289 vulnerabilities →