UpHeron
All vulnerabilities

Servers and applications

CVE-2026-124716

Apache APISIX: authz-keycloak authorization scope mismatch

Severity
Medium 6.4
Published
13 Nov 2026
Last changed
13 Nov 2026
Added to UpHeron
13 Nov 2026
Weakness
Incorrect authorization (CWE-863)
Attack
Over the network · Needs a user account · No user action needed
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N
Sources
CVE Program

Description

Incorrect Authorization vulnerability in Apache APISIX.

An authenticated user who holds any one of a route's required permissions or scopes can reach the protected upstream without the others, including HTTP methods the authorization server denied.

This issue affects Apache APISIX: from 1.4.0 through 3.19.0.

Users are recommended to upgrade to version 3.20.0, which fixes the issue.

From the CVE Program.

Affected software

SoftwareAffected versions
Apache APISIXServers and applications · cna:apache software foundation|apache apisix
  • From 1.4.0 up to 3.19.0

References

  • CVE.org https://www.cve.org/CVERecord?id=CVE-2026-124716