Myracknerd-Ops

Authenticated users with `write:admin` permissions can perform a stored cross-site scripting attack by uploading HTML or SVG files containing JavaScript through the Manager configuration file upload endpoint. An attacker can then direct victims to the unauthenticated image retrieval endpoint, which serves these files as `text/html` or `image/svg+xml`, resulting in the execution of scripts within the application origin.

An improper authorization issue allows realm administrators to access and modify global resources by calling admin endpoints that lack super administrator checks. An attacker can use the '/configuration/manager' endpoint to change the global `keycloakUrl` variable, enabling the redirection of console authentication for other realms to facilitate credential phishing. Additionally, this allows for CSS injection, replacement of map tiles, and deletion of logs.