CVE-2015-3158

CVE-2015-3158 describes a role-based authorization bypass vulnerability in PicketLink versions prior to 2.8.0.Beta1. Specifically, the invokeNextValve function in AbstractIDPValve.java fails to properly enforce authorization, allowing remote authenticated users to access restricted application resources. With a CVSS score of 4.0 (AV:N/AC:L/Au:S/C:P/I:N/A:N), this vulnerability is of low severity, requiring authentication and leading to partial confidentiality impact. There is no evidence of active exploitation, public exploit code (Metasploit, Nuclei, ExploitDB), or significant community discussion or media coverage surrounding this CVE.