Keycloak-services: keycloak-services: uma protection api resourcetype field not validated — cross-owner resource access
- Exploited
- No known exploitation
- Fix
- No fix listed
- Who is exposed
- Specific setups only
Do first: Check whether your setup matches what the bug needs. Attacker must be an authenticated realm user who has at least one resource Attacker must know the victim's resourceType string
- Last modified
- A 0-100 score for how much a CVE matters across the industry: exploitation, exposure, how widely the software is used, severity and whether a fix exists.What do these mean? →
- 32/100 · provisional
- How many real-world setups can hit the bug, from the vendor's advisory and CISA data. It does not know your setup.What do these mean? →
- Specific setups only
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
- Exploitation: none
- Automatable: no
- Technical impact: total
Summary
The Keycloak authorization server, specifically its UMA Protection API for managing user permissions, is affected. A user with low-privilege login access can remotely create a policy that applies to resources owned by other users, which may allow unauthorized access to or modification of sensitive data across the realm.
Written by anthropic/claude-haiku-5.5 from the sources below. Verify against them.
Read the original description
A flaw was found in the UserManagedPermissionService of the Keycloak authorization server. The UMA Protection API, which manages user permissions, fails to validate the resourceType field when a user creates a new policy. This allows an attacker to create a policy that applies to resources owned by other users, potentially leading to unauthorized access or modification of sensitive data across the entire realm.
cve.now Index
- Exploitation0/40No signal
- Exposure8/25Specific setups only, reachable over the network
- Reach10/20Shipped in major Linux distributions
- Severity9.1/10CVSS 8.1, total technical impact per CISA
- No patch5/5No patch listed yet
What would change the score
- Would score about 82 if added to CISA KEV
- Would score about 77 if CISA's SSVC rates exploitation active
- Would score about 39 if CISA's SSVC rates it automatable
What to do
Check whether your setup matches what the bug needs.
Attacker must be an authenticated realm user who has at least one resource Attacker must know the victim's resourceType stringWorkaround: The checked facts do not list a workaround or mitigation. Until a fix is available, follow the vendor advisory for any guidance on limiting UMA resource use.
Timeline
- CVE published
- First seen by cve.now
- CISA SSVC assessment
Exploitation: none · Automatable: no · Technical impact: total
- Record last updated
Affected versions
- keycloak-services
Version range not reported
- rhbk/keycloak-rhel9
Version range not reported
- keycloak-services
Version range not reported
Evidence 2
- Report
- Link
Corrections
None so far.
Something wrong on this page? Report an error. Every fix is listed here.
Questions about CVE-2026-114232
Is CVE-2026-114232 being exploited?
It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked.Source: cve.now feed data
What does this mean?
An authenticated realm user who owns at least one resource can obtain a Requesting Party Token (RPT) that grants access to resources owned by other users, if they know the victim's resourceType string. The advisory says this can let the attacker view sensitive information or perform unauthorized actions on those resources.Source: bugzilla.redhat.com
Am I affected, and how do I check?
The listed products are Red Hat Build of Keycloak and Red Hat Single Sign-On 7, but the checked facts give no version ranges. The bug requires an authenticated realm user with at least one resource and knowledge of the victim's resourceType string, so check the installed Keycloak or RH-SSO version against the vendor advisory.Source: bugzilla.redhat.com
How do I fix CVE-2026-114232?
The checked facts do not name a fixed release, so no upgrade target can be given. Check the Red Hat advisory for the first fixed version of your product line and update to it.Source: bugzilla.redhat.com
What if there's no patch?
The checked facts do not list a workaround or mitigation. Until a fix is available, follow the vendor advisory for any guidance on limiting UMA resource use.Source: bugzilla.redhat.com