A vulnerability was found in Keycloak where an Insecure Direct Object Reference (IDOR) exists in the UMA resource registration endpoint (POST /realms/{realm}/authz/protection/resource_set). When remote resource management is enabled (allowRemoteResourceManagement=true), the keycloak-services component fails to verify resource ownership when a request body contains an existing resource _id. An authenticated attacker with the uma_protection role can exploit this by supplying the ID of a resource owned by another user or the resource server client. Successful exploitation allows the attacker to modify the target resource's configuration, including its name, URIs, scopes, and attributes, bypassing intended ownership restrictions.