Bug 2558074 (CVE-2026-114232)

Summary: CVE-2026-114232 keycloak-services: keycloak-services: UMA Protection API resourceType field not validated — cross-owner resource access
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security <prodsec-ir-bot>
Status: NEW --- QA Contact:
Severity: high Docs Contact:
Priority: high    
Version: unspecifiedCC: aschwart, aszczucz, boliveir, drichtar, mposolda, pjindal, rmartinc, security-response-team, ssilvert, sthorger, vmuzikar
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in the UserManagedPermissionService of the Keycloak authorization server. The UMA Protection API, which manages user permissions, fails to validate the resourceType field when a user creates a new policy. This allows an attacker to create a policy that applies to resources owned by other users, potentially leading to unauthorized access or modification of sensitive data across the entire realm.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Deadline: 2027-01-17   

Description OSIDB Bzimport 2026-10-21 06:12:38 UTC 
A Missing Authorization vulnerability was identified in Keycloaks UMA Protection API. The issue exists in the UserManagedPermissionService where the resourceType field is not validated during policy creation. An authenticated user with the ability to create their own resources can craft a policy request specifying a resourceType that they do not own. During evaluation in the DefaultPolicyEvaluator, the authorization server matches this policy against all resources of that type, regardless of ownership.
Exploitation requires the attacker to be an authenticated realm user with at least one resource and knowledge of the victims resourceType string. Successful exploitation allows an attacker to obtain a Requesting Party Token (RPT) that grants access to resources owned by other users, enabling them to view sensitive information or perform unauthorized actions on those resources.