CVE-2012-5626: Red Hat JBoss Brms

High severity, CVSS 7.5. EPSS: 0.9% chance of exploitation in the next 30 days.

EJB method in Red Hat JBoss BRMS 5; Red Hat JBoss Enterprise Application Platform 5; Red Hat JBoss Operations Network 3.1; Red Hat JBoss Portal 4 and 5; Red Hat JBoss SOA Platform 4.2, 4.3, and 5; in Red Hat JBoss Enterprise Web Server 1 ignores roles specified using the @RunAs annotation.

Affected products

• Red Hat JBoss Brms: version 5 only
• Red Hat JBoss Enterprise Application Platform: version 5.0.0 only
• Red Hat JBoss Enterprise Web Server: version 1.0.0 only
• Red Hat JBoss Operations Network: version 3.1 only
• Red Hat JBoss Portal: version 4.0.0 only; version 5.0.0 only
• Red Hat JBoss Soa Platform: version 4.2 only; version 4.3 only; version 5 only

Published 2020-01-23. Last modified 2026-06-16.