CVE-2026-118947: Keycloak-services: keycloak-services: authorization bypass via uma resource registration idor
A flaw was found in the UMA resource registration endpoint of the keycloak-services component, which provides the core logic for Keycloak's authorization and identity services. The issue occurs when remote resource management is enabled, allowing an authenticated user with specific permissions to update resources they do not own by providing a target resource ID in a request. This can lead to unauthorized modification of resource configurations, such as names, URIs, and scopes.
Other sources
A vulnerability was found in Keycloak where an Insecure Direct Object Reference (IDOR) exists in the UMA resource registration endpoint (POST /realms/{realm}/authz/protection/resourceset). When remote resource management is enabled (allowRemoteResourceManagement=true), the keycloak-services component fails to verify resource ownership when a request body contains an existing resource id. An authenticated attacker with the umaprotection role can exploit this by supplying the ID of a resource owned by another user or the resource server client. Successful exploitation allows the attacker to modify the target resource's configuration, including its name, URIs, scopes, and attributes, bypassing intended ownership restrictions.
— Red Hat
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Deployments are exposed when remote resource management is enabled for the affected authorization setup (allowRemoteResourceManagement=true). Exploitation also requires an authenticated account with the uma_protection role.
What access does an attacker need to modify another party's resource?
The attacker needs to authenticate and hold the uma_protection role, then submit a request to the UMA resource registration endpoint containing the ID of an existing resource owned by another user or by the resource server client.
What could be modified through successful exploitation?
An attacker can alter the target resource's configuration, including its name, URIs, scopes, and attributes. The provided data describes unauthorized modification rather than disclosure or availability impact.