Medium
4.3
Keycloak has Improper Access Control that allows attackers with valid credentials to bypass the allowRemoteResourceManagement=false
CVE-2026-4628
First seen on SecPulse
Affected packages
| Ecosystem | Package | Affected | Fixed |
|---|---|---|---|
| Red Hat | Red Hat build of Keycloak 26.4.12 | — | — |
| Red Hat | Red Hat Build of Keycloak | — | — |
| Red Hat | Red Hat JBoss Enterprise Application Platform 8 | — | — |
| Red Hat | Red Hat JBoss Enterprise Application Platform Expansion Pack | — | — |
| Red Hat | Red Hat Single Sign-On 7 | — | — |
| maven | org.keycloak:keycloak-services |
≤ 26.6.0 |
— |
Original description The description as published by the source.
A flaw was found in Keycloak. An improper Access Control vulnerability in Keycloak’s User-Managed Access (UMA) resource_set endpoint allows attackers with valid credentials to bypass the allowRemoteResourceManagement=false restriction. This occurs due to incomplete enforcement of access control checks on PUT operations to the resource_set endpoint. This issue enables unauthorized modification of protected resources, impacting data integrity.
Source: CVE.org (CVE Program・cvelistV5) NVD GitHub Advisory
References
- advisory nvd.nist.gov
- patch secalert@redhat.com
- patch secalert@redhat.com
- web secalert@redhat.com
- web github.com
- web github.com