Keycloak: incorrect ownership checks in /uma-policy/

Summary

A flaw was found in Keycloak. A significant Broken Access Control vulnerability exists in the UserManagedPermissionService (UMA Protection API). When updating or deleting a UMA policy associated with multiple resources, the authorization check only verifies the caller's ownership against the first resource in the policy's list. This allows a user (Owner A) who owns one resource (RA) to update a shared policy and modify authorization rules for other resources (e.g., RB) in that same policy, even if those other resources are owned by a different user (Owner B). This constitutes a horizontal privilege escalation.

Timeline

1. Feb 9, 2026, 6:58 PM UTCCVE published
2. Feb 9, 2026, 7:51 PM UTCCISA SSVC assessment

   Exploitation: none · Automatable: no · Technical impact: partial

3. Feb 10, 2026, 1:04 AM UTCRecord last updated

Affected versions

• rhbk/keycloak-operator-bundle

  Version range not reported

• rhbk/keycloak-rhel9

  Version range not reported

• rhbk/keycloak-rhel9-operator

  Version range not reported

• rhbk/keycloak-rhel9-operator

  Version range not reported

• rhbk/keycloak-operator-bundle

  Version range not reported

• rhbk/keycloak-rhel9

  Version range not reported

• rhbk/keycloak-rhel9-operator

  Version range not reported

• rhbk/keycloak-rhel9-operator

  Version range not reported

• org.keycloak:keycloak-servicesMaven

  fixed in 26.2.13

• org.keycloak:keycloak-servicesMaven

  From 26.5.0 · fixed in 26.5.3

• org.keycloak:keycloak-servicesMaven

  From 26.3.0 · fixed in 26.4.9

References 6