← CVE Intelligence

CVE-2026-4636

Keycloak: keycloak: uma policy bypass allows authenticated users to gain unauthorized access to victim-owned resources. PUBLISHED

Description (CNA)

A flaw was found in Keycloak. An authenticated user with the uma_protection role can bypass User-Managed Access (UMA) policy validation. This allows the attacker to include resource identifiers owned by other users in a policy creation request, even if the URL path specifies an attacker-owned resource. Consequently, the attacker gains unauthorized permissions to victim-owned resources, enabling them to obtain a Requesting Party Token (RPT) and access sensitive information or perform unauthorized actions.

Affected (CNA)

Vendor / productVersions
Red Hat / Red Hat build of Keycloak 26.2unaffected 26.2.15-1 before *
Red Hat / Red Hat build of Keycloak 26.2unaffected 26.2-18 before *
Red Hat / Red Hat build of Keycloak 26.2unaffected 26.2-18 before *
Red Hat / Red Hat build of Keycloak 26.2.15unaffected
Red Hat / Red Hat build of Keycloak 26.4unaffected 26.4.11-1 before *
Red Hat / Red Hat build of Keycloak 26.4unaffected 26.4-14 before *
Red Hat / Red Hat build of Keycloak 26.4unaffected 26.4-14 before *
Red Hat / Red Hat build of Keycloak 26.4.11unaffected

CWE

CWE-551

References

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.

redhat-SADP

A flaw was found in Keycloak. An authenticated user with the uma_protection role can bypass User-Managed Access (UMA) policy validation. This allows the attacker to include resource identifiers owned by other users in a policy creation request, even if the URL path specifies an attacker-owned resource. Consequently, the attacker gains unauthorized permissions to victim-owned resources, enabling them to obtain a Requesting Party Token (RPT) and access sensitive information or perform unauthorized actions.