GitHub Advisoryadvisory · Maven

GHSA-f2hx-5fx3-hmcv Keycloak: UMA Policy Resource Injection Allows Unauthorized Cross-User Permission Grants

HIGH Published 2026-04-02 Modified 2026-04-04 Official page ↗
Aliases
CVE-2026-4636
Ecosystem
Maven
Packages
org.keycloak:keycloak-services
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Weaknesses
CWE-551
Reviewed
2026-04-04

Affected packages

• Maven org.keycloak:keycloak-services: < 26.5.7 → fixed in 26.5.7

Description

A flaw was found in Keycloak. An authenticated user with the uma_protection role can bypass User-Managed Access (UMA) policy validation. This allows the attacker to include resource identifiers owned by other users in a policy creation request, even if the URL path specifies an attacker-owned resource. Consequently, the attacker gains unauthorized permissions to victim-owned resources, enabling them to obtain a Requesting Party Token (RPT) and access sensitive information or perform unauthorized actions.

Related

Alias · CVE (1)

Weakness · CWE (1)

  • CWE-551 Incorrect Behavior Order: Authorization Before Parsing and Canonicalization weakness

References