Description
A flaw was found in Keycloak. An authenticated user with the uma_protection role can bypass User-Managed Access (UMA) policy validation. This allows the attacker to include resource identifiers owned by other users in a policy creation request, even if the URL path specifies an attacker-owned resource. Consequently, the attacker gains unauthorized permissions to victim-owned resources, enabling them to obtain a Requesting Party Token (RPT) and access sensitive information or perform unauthorized actions.
INFO
Published Date :
2026-04-02T12:45:01.841Z
Last Modified :
2026-04-02T16:35:04.681Z
Source :
redhat
AFFECTED PRODUCTS
The following products are affected by CVE-2026-4636 vulnerability.
| Vendors | Products |
|---|---|
| Redhat |
|
REFERENCES
Here, you will find a curated list of external links that provide in-depth information to CVE-2026-4636.
