4.3
MediumCVSS 3.1 · from redhat
CVE-2026-118947
Keycloak-services: keycloak-services: authorization bypass via uma resource registration idor
keycloak-services · Authorization bypass via user key · CWE-639Affectedkeycloak-services, rhbk/keycloak-rhel9, keycloak-services
FixNo fix listed yet.
PublishedOct 30, 00:13 · redhat
ScoredOct 30 · 4.3 · redhat
Exploit code publicNone known · checked 21:18 UTC
ExploitedNone known · CISA KEV checked 22:08 UTC
What we know
No known exploitation. CISA KEV, checked 22:08 UTC.
No public exploit code known. Exploit-DB, Metasploit, Nuclei, checked 21:18 UTC.
An attacker needs network access and an account. CVSS: network, low privileges.
Description
A flaw was found in the UMA resource registration endpoint of the keycloak-services component, which provides the core logic for Keycloak's authorization and identity services. The issue occurs when remote resource management is enabled, allowing an authenticated user with specific permissions to update resources they do not own by providing a target resource ID in a request. This can lead to unauthorized modification of resource configurations, such as names, URIs, and scopes.
From redhat
Affected and fixed versions
ProductAffectedFixed inkeycloak-servicesall versions–rhbk/keycloak-rhel9all versions–keycloak-servicesnot stated–
Exploit code
Exploit-DBnone knownMetasploitnone knownNucleinone known