CVE-2026-114232: Keycloak-services: keycloak-services: uma protection api resourcetype field not validated — cross-owner resource access
A flaw was found in the UserManagedPermissionService of the Keycloak authorization server. The UMA Protection API, which manages user permissions, fails to validate the resourceType field when a user creates a new policy. This allows an attacker to create a policy that applies to resources owned by other users, potentially leading to unauthorized access or modification of sensitive data across the entire realm.
Other sources
A Missing Authorization vulnerability was identified in Keycloaks UMA Protection API. The issue exists in the UserManagedPermissionService where the resourceType field is not validated during policy creation. An authenticated user with the ability to create their own resources can craft a policy request specifying a resourceType that they do not own. During evaluation in the DefaultPolicyEvaluator, the authorization server matches this policy against all resources of that type, regardless of ownership. Exploitation requires the attacker to be an authenticated realm user with at least one resource and knowledge of the victims resourceType string. Successful exploitation allows an attacker to obtain a Requesting Party Token (RPT) that grants access to resources owned by other users, enabling them to view sensitive information or perform unauthorized actions on those resources.
— Red Hat
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker must be an authenticated realm user, be able to create their own resources, and have at least one resource. They also need to know the resourceType string used by the victim's resources.
What access could a successful attacker gain?
The attacker can create a policy using a resourceType they do not own. Because policy evaluation matches resources of that type regardless of owner, they may obtain a Requesting Party Token granting access to resources owned by other users in the realm.
Which deployments are exposed?
Deployments using Keycloak's UMA Protection API and user-managed permissions are relevant. The issue is triggered during policy creation in UserManagedPermissionService and evaluation by DefaultPolicyEvaluator.