CVEvulnerability

CVE-2026-4636

8.1 HIGH Published 2026-04-02 Modified 2026-10-26 Official page ↗
Status
Modified
Published
2026-04-02
Last modified
2026-10-26
Assigner
[email protected]
CVSS 3.1 ([email protected])
8.1 HIGH — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
CVSS 3.1 (0b0ca135-0b70-47e7-9f44-1890c2a1c46c)
8.1 HIGH — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Weaknesses
CWE-551

Description

A flaw was found in Keycloak. An authenticated user with the uma_protection role can bypass User-Managed Access (UMA) policy validation. This allows the attacker to include resource identifiers owned by other users in a policy creation request, even if the URL path specifies an attacker-owned resource. Consequently, the attacker gains unauthorized permissions to victim-owned resources, enabling them to obtain a Requesting Party Token (RPT) and access sensitive information or perform unauthorized actions.

Affected configurations

• redhat build of keycloak • redhat build of keycloak 26.2 • redhat build of keycloak 26.2.15 • redhat build of keycloak 26.4 • redhat build of keycloak 26.4.11

Related

Weakness · CWE (1)

  • CWE-551 Incorrect Behavior Order: Authorization Before Parsing and Canonicalization weakness

References