Summary:

IDOR vulnerability in the Keycloak Authorization Services Protection
API endpoint /realms/{realm}/authz/protection/resource_set/{id} allows
authenticated clients to perform GET, PUT, and DELETE operations on
resources belonging to other Resource Servers within the same realm.
The endpoint fails to validate that the requested resource UUID
belongs to the calling Resource Server.

Requirements to exploit:

Attacker must possess valid client credentials for any Resource Server
with Authorization Services enabled in the target realm, and must know
or obtain the UUID of a resource belonging to another Resource Server.

Steps to reproduce:

1. Configure a Keycloak realm with two clients (clientA, clientB) with
Authorization Services enabled and allowRemoteResourceManagement=true
2. Create a resource under clientB and note its UUID
3. Obtain a client_credentials token for clientA using its client secret
4. Using clientA's token, send GET
/realms/{realm}/authz/protection/resource_set/{clientB-resource-uuid}
— returns 200 with clientB's resource data
5. Send PUT to the same endpoint with modified payload — returns 204,
resource is modified
6. Send DELETE to the same endpoint — note: triagers reported this
fails with an authorization error in 26.5.4, but GET and PUT succeed
7. Confirm modification by querying with clientB's token