KEYCLOAK-SERVICES · CVE-2026-114232 · Infrastructure
FIX → 26.8.2 ✓ verified
Keycloak's UMA Protection API does not validate the resourceType field when a user creates a permission policy. An attacker can create a policy that applies to resources owned by other users in the realm, leading to unauthorized access or modification of data.
first public Nov 5, 2026 · 2 sources
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Self-hosted Keycloak realms where authenticated users can reach the UMA Protection API (Authorization Services with user-managed permissions). Any authenticated user who can create policies could create one covering other users' resources in the same realm, reading or changing them. Realms that do not use UMA / Authorization Services can likely skip it, but the vendor pages do not say which configurations are exposed. Red Hat lists Red Hat Build of Keycloak as affected.
Not affected if uma-disabled
Who cares keycloak, self-hosted, sso
26.8.2 on the 26.8 line are not confirmed fixedUpgrade to 26.8.2
A flaw was found in the UserManagedPermissionService of the Keycloak authorization server. The UMA Protection API, which manages user permissions, fails to validate the resourceType field when a user creates a new policy. This allows an attacker to create a policy that applies to resources owned by other users, potentially leading to unauthorized access or modification of sensitive data across the entire realm.
This page as .md · .json · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
26.8.2 (listed under security fixes in the 26.8.2 release notes, issue #54696)