A Role-Based Access Control (RBAC) bypass vulnerability was discovered in WildFly Core's deployment-operation family. The root cause is the missing SensitivityClassification.READ_WHOLE_CONFIG on several operation handlers, including upload-deployment-url.
Under normal RBAC constraints, a user in the "Maintainer" role is denied access to sensitive configuration data. However, due to this flaw, a Maintainer can use these handlers to exfiltrate sensitive files from the server process, such as standalone.xml and mgmt-users.properties. These files contain HA1 password hashes for other administrative users. An attacker can then use these hashes to forge HTTP Digest authentication responses, effectively escalating their privileges to SuperUser and gaining full control over the server.