Executive brief
A security flaw in Keycloak's authorization component allows an authenticated user to bypass access controls for certain resources. By using a specific request format, a user who has permission for one item can gain unauthorized access to all other items of the same type on the server. This could lead to the unauthorized viewing or modification of sensitive data managed by the identity provider.
Technical details
A vulnerability exists in the org.keycloak.authorization component of Keycloak due to improper validation of User-Managed Access (UMA) permission requests. An authenticated attacker with a valid permission ticket for a single resource can use a specific permission request prefix to bypass per-resource access controls. This allows unauthorized access to all resources of that type within the same resource server. The vulnerability specifically affects environments where the resource server is in PERMISSIVE policy enforcement mode, ownerManagedAccess is enabled for typed resources, and no explicit policy protects the resource type. This can result in unauthorized information disclosure or modification.
Affected products
- Red Hat Keycloak Red Hat Build of Keycloak
Timeline
- 2026-05-28: other: Reported to Red Hat Bugzilla
- 2026-06-25: disclosed: CVE published