CVE-2026-4636: Keycloak: keycloak: uma policy bypass allows authenticated users to gain unauthorized access to victim-owned resources.

The vulnerability is a UMA policy bypass in the /realms/{realm}/authz/protection/uma-policy/{resourceId} endpoint. The create-path validation only checks ownership for the resource ID in the URL path, but the request body accepts a "resources" array that can include additional resource IDs owned by other users. When the policy is created, it grants the attacker permissions to all listed resources, including victim-owned ones. The attacker can then request an RPT (Requesting Party Token) for victim resources and receive valid permissions.

Requirements to exploit: Authenticated user with umaprotection role, victim must have created UMA-protected resources with ownerManagedAccess enabled, authorization services enabled on the client.

Steps to reproduce:

1. Deploy Keycloak with a client configured with authorizationServicesEnabled:true 2. Create two users (attacker, victim) and assign both the umaprotection client role 3. As victim, create a UMA resource via POST /realms/{realm}/authz/protection/resourceset with ownerManagedAccess:true and scopes:["view"] → note the victimresourceid 4. As attacker, obtain access token and create own UMA resource via same endpoint → note the attackerresourceid 5. As attacker, POST to /realms/{realm}/authz/protection/uma-policy/{attackerresourceid} with body: {"name":"malicious-policy","scopes":["view"],"users":["attacker"],"resources":["{attackerresourceid}","{victimresourceid}"]} 6. Observe policy creation succeeds (HTTP 200) despite including victim-owned resource 7. As attacker, POST to /realms/{realm}/protocol/openid-connect/token with granttype=urn:ietf:params:oauth:grant-type:uma-ticket, audience={clientid}, permission={victimresourceid}#view 8. Attacker receives valid RPT (HTTP 200) containing permissions for victim resource, which was denied (HTTP 403) before the exploit

— Red Hat