Improper Access Control vulnerability in Keycloak’s UMA resource_set endpoint allows bypass of the allowRemoteResourceManagement=false restriction. The flaw occurs due to incomplete enforcement of access control checks on PUT operations to /realms/{realm}/authz/protection/resource_set/{id}. While remote resource management is intended to be disabled, attackers with valid credentials can still update existing resources. This issue enables unauthorized modification of protected resources without requiring additional privileges or user interaction, impacting data integrity.