CVE-2026-4628: Keycloak improper access control in UMA resource_set endpoint

Executive brief

Keycloak, an open-source identity and access management solution, contains a security flaw in its resource management component. An attacker with valid login credentials can bypass security restrictions to modify protected resources that should be locked. This could lead to unauthorized changes to sensitive data or system configurations, potentially compromising the integrity of the identity management system.

Technical details

An improper access control vulnerability (CWE-284) exists in Keycloak's User-Managed Access (UMA) resource_set endpoint. The vulnerability stems from incomplete enforcement of access control checks during HTTP PUT operations. Specifically, an attacker with valid credentials can bypass the 'allowRemoteResourceManagement=false' configuration setting. This allows unauthorized modification of protected resources via the resource_set endpoint. The issue affects versions up to and including 26.6.0; as of the advisory date, no patched version is specified.

Affected products

• Keycloak Keycloak <= 26.6.0

Timeline

• 2026-03-23: disclosed
• 2026-03-23: advisory

References

• https://api.github.com/users/dnegreira
• https://github.com/dnegreira
• https://api.github.com/users/dnegreira/gists%7B/gist_id%7D
• https://api.github.com/users/dnegreira/repos
• https://avatars.githubusercontent.com/u/5215383?v=4
• https://api.github.com/users/dnegreira/events%7B/privacy%7D