Summary:

IDOR vulnerability in the Keycloak Authorization Services Protection API endpoint /realms/{realm}/authz/protection/resourceset/{id} allows authenticated clients to perform GET, PUT, and DELETE operations on resources belonging to other Resource Servers within the same realm. The endpoint fails to validate that the requested resource UUID belongs to the calling Resource Server.

Requirements to exploit:

Attacker must possess valid client credentials for any Resource Server with Authorization Services enabled in the target realm, and must know or obtain the UUID of a resource belonging to another Resource Server.

Steps to reproduce:

1. Configure a Keycloak realm with two clients (clientA, clientB) with Authorization Services enabled and allowRemoteResourceManagement=true 2. Create a resource under clientB and note its UUID 3. Obtain a clientcredentials token for clientA using its client secret 4. Using clientA's token, send GET /realms/{realm}/authz/protection/resourceset/{clientB-resource-uuid} — returns 200 with clientB's resource data 5. Send PUT to the same endpoint with modified payload — returns 204, resource is modified 6. Send DELETE to the same endpoint — note: triagers reported this fails with an authorization error in 26.5.4, but GET and PUT succeed 7. Confirm modification by querying with clientB's token