Eclipse Kura versions 5.1.0 through 5.6.2 contain a vulnerability in the Configuration REST API v2 that allows authenticated users with limited permissions to access and modify sensitive user configuration data. Specifically, users with the rest.configuration permission can read password hashes stored as unsalted SHA-256 digests, modify identities and permissions, and restore configuration snapshots, enabling privilege escalation to full administrative rights. This issue is resolved in version 5.6.3.