Bug 2563274 (CVE-2026-118947)
| Summary: | CVE-2026-118947 keycloak-services: keycloak-services: Authorization bypass via UMA resource registration IDOR | ||
|---|---|---|---|
| Product: | [Other] Security Response | Reporter: | OSIDB Bzimport <bzimport> |
| Component: | vulnerability | Assignee: | Product Security <prodsec-ir-bot> |
| Status: | NEW --- | QA Contact: | |
| Severity: | medium | Docs Contact: | |
| Priority: | medium | ||
| Version: | unspecified | CC: | aschwart, aszczucz, boliveir, drichtar, mposolda, pjindal, rmartinc, ssilvert, sthorger, vmuzikar |
| Target Milestone: | --- | Keywords: | Security |
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | --- | |
| Doc Text: |
A flaw was found in the UMA resource registration endpoint of the keycloak-services component, which provides the core logic for Keycloak's authorization and identity services. The issue occurs when remote resource management is enabled, allowing an authenticated user with specific permissions to update resources they do not own by providing a target resource ID in a request. This can lead to unauthorized modification of resource configurations, such as names, URIs, and scopes.
|
Story Points: | --- |
| Clone Of: | Environment: | ||
| Last Closed: | Type: | --- | |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
A vulnerability was found in Keycloak where an Insecure Direct Object Reference (IDOR) exists in the UMA resource registration endpoint (POST /realms/{realm}/authz/protection/resource_set). When remote resource management is enabled (allowRemoteResourceManagement=true), the keycloak-services component fails to verify resource ownership when a request body contains an existing resource _id. An authenticated attacker with the uma_protection role can exploit this by supplying the ID of a resource owned by another user or the resource server client. Successful exploitation allows the attacker to modify the target resource's configuration, including its name, URIs, scopes, and attributes, bypassing intended ownership restrictions.