CVE-2026-47839
A flaw in OIDC provider configuration lets authenticated users gain the uaa.admin scope even when operators try to block that provider. The issue arises when groupMappingMode is set to AS_SCOPES and a wildcard is used in externalGroupsWhitelist, giving attackers administrative rights.
No official fix yet. If none appears within 45 days of first tracking, this entry is removed automatically.
Who is affected
Systems that use an OIDC identity provider configured with groupMappingMode AS_SCOPES and a wildcard externalGroupsWhitelist, such as certain UAA deployments. No specific product is listed in the data.
Real-world impact
An attacker can obtain the uaa.admin scope, giving them full administrative privileges over the affected system.
Why this severity
The CVSS score of 9.2 reflects a network-based attack that requires high complexity but no user interaction, and it grants complete confidentiality, integrity, and availability impact by allowing privilege escalation to admin level.
What to do about it
No official fix or mitigation is documented in the sources yet. Monitor the vendor advisory and apply the patch as soon as it is released.
No fix documented in sources