CVE-2019-11278: Cloudfoundry User Account And Authentication

High severity, CVSS 8.8. EPSS: 1.3% chance of exploitation in the next 30 days.

CF UAA versions prior to 74.1.0, allow external input to be directly queried against. A remote malicious user with 'client.write' and 'groups.update' can craft a SCIM query, which leaks information that allows an escalation of privileges, ultimately allowing the malicious user to gain control of UAA scopes they should not have.

Affected products

• Cloudfoundry User Account And Authentication: before 74.1.0 (fixed in 74.1.0)

Published 2019-09-26. Last modified 2026-06-17.