8.1

CVE-2026-4636

Exploit

Keycloak: keycloak: uma policy bypass allows authenticated users to gain unauthorized access to victim-owned resources.

A flaw was found in Keycloak. An authenticated user with the uma_protection role can bypass User-Managed Access (UMA) policy validation. This allows the attacker to include resource identifiers owned by other users in a policy creation request, even if the URL path specifies an attacker-owned resource. Consequently, the attacker gains unauthorized permissions to victim-owned resources, enabling them to obtain a Requesting Party Token (RPT) and access sensitive information or perform unauthorized actions.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Redhat ≫ Build Of Keycloak Version- SwEditiontext-only
Redhat ≫ Build Of Keycloak Version26.2 SwEditiontext-only
Redhat ≫ Build Of Keycloak Version26.2.15 SwEditiontext-only
Redhat ≫ Build Of Keycloak Version26.4 SwEditiontext-only
Redhat ≫ Build Of Keycloak Version26.4.11 SwEditiontext-only
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. Login Login
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.35% 0.265
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
secalert@redhat.com 8.1 2.8 5.2
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
0b0ca135-0b70-47e7-9f44-1890c2a1c46c 8.1 2.8 5.2
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
CWE-551 Incorrect Behavior Order: Authorization Before Parsing and Canonicalization

If a web server does not fully parse requested URLs before it examines them for authorization, it may be possible for an attacker to bypass authorization protection.

https://access.redhat.com/security/cve/CVE-2026-4636
Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2450251
Vendor Advisory
Exploit
Issue Tracking
https://access.redhat.com/errata/RHSA-2026:6477
Vendor Advisory
https://access.redhat.com/errata/RHSA-2026:6478
Vendor Advisory
https://access.redhat.com/errata/RHSA-2026:6475
Vendor Advisory
https://access.redhat.com/errata/RHSA-2026:6476
Vendor Advisory
https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-4636.json