{"id":"CVE-2026-114232","kind":"vulnerability","aliases":["CVE-2026-114232"],"related":[],"title":"Keycloak: missing resourceType check lets users create policies over others' resources","description":"A flaw was found in the UserManagedPermissionService of the Keycloak authorization server. The UMA Protection API, which manages user permissions, fails to validate the resourceType field when a user creates a new policy. This allows an attacker to create a policy that applies to resources owned by other users, potentially leading to unauthorized access or modification of sensitive data across the entire realm.","summary":"Keycloak's UMA Protection API does not validate the resourceType field when a user creates a permission policy. An attacker can create a policy that applies to resources owned by other users in the realm, leading to unauthorized access or modification of data.","severity":"high","cvss":8.1,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"keycloak-services","fixed":["26.8.2"],"affected":"< 26.8.2 (lower bound not stated by sources)","ecosystem":"maven"}],"ecosystems":[],"tags":["infrastructure","keycloak","self-hosted","sso"],"not_affected_if":["uma-disabled"],"how_to_check":"Check your Keycloak version (Admin Console > Server info, or bin/kc.sh --version); versions older than 26.8.2 on the 26.8 line are not confirmed fixed. Also check whether any client uses UMA / Authorization Services user-managed permissions (UMA Protection API, uma_protection role); the vendor pages do not say whether it is on by default. Red Hat Build of Keycloak users: check Red Hat's advisory for their fixed build.","fix":"Upgrade Keycloak to 26.8.2 (listed under security fixes in the 26.8.2 release notes, issue #54696). Red Hat says no mitigation is available.","status":"open","published_at":"2026-11-05T17:17:39+00:00","first_seen_at":"2026-11-05T17:40:03+00:00","triaged_at":"2026-11-05T17:42:17+00:00","updated_at":"2026-11-05T17:45:12+00:00","category":"infrastructure","confidence":0.7,"triage":{"at":"2026-11-05T17:42:17Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Keycloak: missing resourceType check lets users create policies over others' resources","impact":"high","summary":"Keycloak's UMA Protection API does not validate the resourceType field when a user creates a permission policy. An attacker can create a policy that applies to resources owned by other users in the realm, leading to unauthorized access or modification of data.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["keycloak","self-hosted","sso"],"confidence":0.5,"fix_status":"unknown","needs_auth":"yes","worst_case":"attacker gains unauthorized access to or modifies other users' resources","analyst_note":"Check the NVD entry and the Keycloak security advisory for affected and fixed versions, and whether UMA user-managed permissions are enabled by default.","how_to_check":"unknown","plain_action":"","needs_analyst":true,"not_affected_if":["uma-disabled"],"who_is_affected":"Organisations running Keycloak as their authorization server with the UMA Protection API reachable by users who can create policies. Deployments that do not use UMA user-managed permissions are likely not affected, but the sources do not say which configurations are exposed.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000652,"input_tokens":4236,"output_tokens":457,"severity_before":"high"},"analyst_status":"done","analyst_note":"Check the NVD entry and the Keycloak security advisory for affected and fixed versions, and whether UMA user-managed permissions are enabled by default.","search":"'-114232':14A,17A '-2026':13A,16A 'access':65B,123C 'across':129C 'allow':104C 'api':31B,85C 'appli':52B,112C 'attack':46B,106C 'author':80C 'check':4A 'creat':7A,41B,48B,99C,108C 'cve':12A,15A 'data':69B,128C 'entir':131C 'fail':90C 'field':37B,95C 'flaw':71C 'found':73C 'host':25B 'infrastructur':21B 'keycloak':1A,19A,22B,27B,79C 'keycloak-services':18A 'lead':62B,120C 'let':5A 'manag':87C 'miss':2A 'modif':67B,125C 'new':101C 'other':10A 'own':55B,115C 'permiss':43B,89C 'polici':8A,44B,50B,102C,110C 'potenti':119C 'protect':30B,84C 'realm':61B,132C 'resourc':11A,54B,114C 'resourcetyp':3A,36B,94C 'self':24B 'self-host':23B 'sensit':127C 'server':81C 'services':20A 'sso':26B 'uma':29B,83C 'unauthor':64B,122C 'user':6A,40B,58B,88C,98C,118C 'usermanagedpermissionservic':76C 'valid':34B,92C","nicknames":[],"mitigations":[],"who_affected":"Self-hosted Keycloak realms where authenticated users can reach the UMA Protection API (Authorization Services with user-managed permissions). Any authenticated user who can create policies could create one covering other users' resources in the same realm, reading or changing them. Realms that do not use UMA / Authorization Services can likely skip it, but the vendor pages do not say which configurations are exposed. Red Hat lists Red Hat Build of Keycloak as affected.","tier":"B","verified":{"fix":{"at":"2026-11-05T17:45:12Z","by":"analyst","doc":"https://access.redhat.com/security/cve/CVE-2026-114232","run_id":1804}},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["keycloakservices"],"ptokens":["keycloak","services"],"labels":["high","infrastructure","keycloak","selfhosted","sso"],"campaign_type":null,"first_public_at":"2026-11-05T17:17:39+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","cvss_by":"secalert@redhat.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-114232","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114232","severity":null,"published_at":"2026-11-05T17:17:39+00:00","modified_at":"2026-11-05T17:17:39+00:00","first_seen_at":"2026-11-05T17:40:03+00:00","fetched_at":"2026-11-05T17:40:03+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-114232:1804","url":"https://github.com/keycloak/keycloak/releases/tag/26.8.2","severity":null,"published_at":"2026-11-05T17:45:12+00:00","modified_at":"2026-11-05T17:45:12+00:00","first_seen_at":"2026-11-05T17:45:12+00:00","fetched_at":"2026-11-05T17:45:12+00:00","note":"Keycloak 26.8.2 release notes list CVE-2026-114232 (#54696) as a security fix; Red Hat page gives description, Important rating, no mitigation, reporter 0xNayel. Affected lower bound and UMA default unknown: advisory text not found; backports to older branches (26.5/26.6) not confirmed. Not exploited, no PoC seen. Did not search social posts.","cites":["https://github.com/keycloak/keycloak/releases/tag/26.8.2","https://access.redhat.com/security/cve/CVE-2026-114232"]}],"documents":[{"id":78339,"url":"https://github.com/keycloak/keycloak/releases/tag/26.8.2","title":"Keycloak 26.8.2 release notes","kind":"release","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"fix","confidence":null,"note":null},{"id":78344,"url":"https://access.redhat.com/security/cve/CVE-2026-114232","title":"Red Hat CVE-2026-114232","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}