Skip to content
CVE PROGRAM SOURCE RECORD8.1 High

CVE-2026-4636

Keycloak: keycloak: uma policy bypass allows authenticated users to gain unauthorized access to victim-owned resources.

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
redhat

Description

A flaw was found in Keycloak. An authenticated user with the uma_protection role can bypass User-Managed Access (UMA) policy validation. This allows the attacker to include resource identifiers owned by other users in a policy creation request, even if the URL path specifies an attacker-owned resource. Consequently, the attacker gains unauthorized permissions to victim-owned resources, enabling them to obtain a Requesting Party Token (RPT) and access sensitive information or perform unauthorized actions.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Red Hat Red Hat build of Keycloak 26.2

Default version status: affected

  • 26.2.15-1 to < *unaffected

Red Hat Red Hat build of Keycloak 26.2

Default version status: affected

  • 26.2-18 to < *unaffected

Red Hat Red Hat build of Keycloak 26.2

Default version status: affected

  • 26.2-18 to < *unaffected

Red Hat Red Hat build of Keycloak 26.2.15

Default version status: unaffected

Red Hat Red Hat build of Keycloak 26.4

Default version status: affected

  • 26.4.11-1 to < *unaffected

Red Hat Red Hat build of Keycloak 26.4

Default version status: affected

  • 26.4-14 to < *unaffected

Red Hat Red Hat build of Keycloak 26.4

Default version status: affected

  • 26.4-14 to < *unaffected

Red Hat Red Hat build of Keycloak 26.4.11

Default version status: unaffected

References