CVE-2026-4636
EUVD-2026-1821302.04.2026, 13:16
A flaw was found in Keycloak. An authenticated user with the uma_protection role can bypass User-Managed Access (UMA) policy validation. This allows the attacker to include resource identifiers owned by other users in a policy creation request, even if the URL path specifies an attacker-owned resource. Consequently, the attacker gains unauthorized permissions to victim-owned resources, enabling them to obtain a Requesting Party Token (RPT) and access sensitive information or perform unauthorized actions.Enginsight
Affected Products (NVD)
| Vendor | Product | Version |
|---|---|---|
| redhat | build_of_keycloak | - |
| redhat | build_of_keycloak | 26.2 |
| redhat | build_of_keycloak | 26.2.15 |
| redhat | build_of_keycloak | 26.4 |
| redhat | build_of_keycloak | 26.4.11 |
𝑥
= Vulnerable software versions
Early Detection
Affected products identified ahead of NVD analysis through intelligence sources.
| Vendor | Product | Version | Source |
|---|---|---|---|
| Red Hat | Red Hat build of Keycloak 26.2 | 26.2.15-1 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat build of Keycloak 26.2 | 26.2-18 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat build of Keycloak 26.2 | 26.2-18 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat build of Keycloak 26.4 | 26.4.11-1 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat build of Keycloak 26.4 | 26.4-14 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat build of Keycloak 26.4 | 26.4-14 ≤ 𝑥 < * | ADP |
References