CVE-2026-4628: Keycloak: org.keycloak.authorization: keycloak: unauthorized resource modification due to improper access control
A flaw was found in Keycloak. An improper Access Control vulnerability in Keycloak’s User-Managed Access (UMA) resourceset endpoint allows attackers with valid credentials to bypass the allowRemoteResourceManagement=false restriction. This occurs due to incomplete enforcement of access control checks on PUT operations to the resourceset endpoint. This issue enables unauthorized modification of protected resources, impacting data integrity.
Other sources
Improper Access Control vulnerability in Keycloak’s UMA resourceset endpoint allows bypass of the allowRemoteResourceManagement=false restriction. The flaw occurs due to incomplete enforcement of access control checks on PUT operations to /realms/{realm}/authz/protection/resourceset/{id}. While remote resource management is intended to be disabled, attackers with valid credentials can still update existing resources. This issue enables unauthorized modification of protected resources without requiring additional privileges or user interaction, impacting data integrity.
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-4628?
CVE-2026-4628 is classified as a high-severity vulnerability due to improper access control in Keycloak.
How do I fix CVE-2026-4628?
To fix CVE-2026-4628, update to the latest version of Keycloak that addresses this improper access control issue.
What specific component is affected by CVE-2026-4628?
CVE-2026-4628 affects the User-Managed Access (UMA) resource_set endpoint in Keycloak.
Who is vulnerable to CVE-2026-4628?
Any Keycloak deployment utilizing the affected version is vulnerable to CVE-2026-4628 if attackers can leverage valid credentials.
What are the potential consequences of CVE-2026-4628?
The consequences of CVE-2026-4628 include unauthorized resource modifications, which can lead to data breaches or unauthorized access.