CVE-2026-4636

A flaw was found in Keycloak. An authenticated user with the uma_protection role can bypass User-Managed Access (UMA) policy validation. This allows the attacker to include resource identifiers owned by other users in a policy creation request, even if the URL path specifies an attacker-owned resource. Consequently, the attacker gains unauthorized permissions to victim-owned resources, enabling them to obtain a Requesting Party Token (RPT) and access sensitive information or perform unauthorized actions.

CVSS 3.1

8.1CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

EPSS

0.4% chance of exploitation in the next 30 days; higher than 36% of CVEs (scores of 2026-10-26)

CWE

CWE-551

Published

2026-04-02

Modified

2026-10-26

Record from

the NVD, synced 2026-10-26

Affected

• redhat:build_of_keycloak

Packages (OSV)

References

• https://access.redhat.com/errata/RHSA-2026:6475
• https://access.redhat.com/errata/RHSA-2026:6476
• https://access.redhat.com/errata/RHSA-2026:6477
• https://access.redhat.com/errata/RHSA-2026:6478
• https://access.redhat.com/security/cve/CVE-2026-4636

Check your stackJSON