A Missing Authorization vulnerability was identified in Keycloaks UMA Protection API. The issue exists in the UserManagedPermissionService where the resourceType field is not validated during policy creation. An authenticated user with the ability to create their own resources can craft a policy request specifying a resourceType that they do not own. During evaluation in the DefaultPolicyEvaluator, the authorization server matches this policy against all resources of that type, regardless of ownership.
Exploitation requires the attacker to be an authenticated realm user with at least one resource and knowledge of the victims resourceType string. Successful exploitation allows an attacker to obtain a Requesting Party Token (RPT) that grants access to resources owned by other users, enabling them to view sensitive information or perform unauthorized actions on those resources.