A flaw in the platform-mbean component of JBoss EAP allows an authenticated user with a low‑privileged role, such as Monitor, to read sensitive JVM properties and configuration data that should be protected by role‑based access control. The missing RBAC check is a classic authorization bypass (CWE‑862). The impact is primarily the confidentiality compromise of system configuration and metadata, with no denial of service or code execution pathways documented.

The vulnerability affects Red Hat JBoss Enterprise Application Platform 7 and 8, the JBoss Enterprise Application Platform Expansion Pack, and Red Hat Single Sign‑On 7. Users running these products are impacted, regardless of version, if the platform-mbean component is enabled.

The CVSS score is 6.5, indicating moderate severity. EPSS data is not available and the vulnerability is not listed in the CISA KEV catalog, suggesting that it has not yet been widely exploited in the wild. The attacker must be authenticated and hold a Monitor‑level role, which is a common privilege for operational staff. Given the internal nature of the access, the likely attack vector is the internal network or management interfaces that expose the MBean server. If an attacker gains or abuses such a role, they can gain visibility into configuration and environment details that could aid further attacks.