---
id: "CVE-2026-114232"
kind: "vulnerability"
aliases: ["CVE-2026-114232"]
title: "Keycloak: missing resourceType check lets users create policies over others' resources"
severity: "high"
cvss: 8.1
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: [{"name": "keycloak-services", "fixed": ["26.8.2"], "affected": "< 26.8.2 (lower bound not stated by sources)", "ecosystem": "maven"}]
ecosystems: []
tags: ["infrastructure", "keycloak", "self-hosted", "sso"]
not_affected_if: ["uma-disabled"]
published_at: "2026-11-05T17:17:39+00:00"
first_seen_at: "2026-11-05T17:40:03+00:00"
updated_at: "2026-11-05T17:45:12+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-114232", "first_seen_at": "2026-11-05T17:40:03+00:00"}, {"source": "analyst", "url": "https://access.redhat.com/security/cve/CVE-2026-114232", "first_seen_at": "2026-11-05T17:45:12+00:00", "cites": ["https://access.redhat.com/security/cve/CVE-2026-114232", "https://github.com/keycloak/keycloak/releases/tag/26.8.2"]}]
exploit_sources: []
---

# Keycloak: missing resourceType check lets users create policies over others' resources

Keycloak's UMA Protection API does not validate the resourceType field when a user creates a permission policy. An attacker can create a policy that applies to resources owned by other users in the realm, leading to unauthorized access or modification of data.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- maven:keycloak-services affected < 26.8.2 (lower bound not stated by sources) fixed 26.8.2

## How to check

Check your Keycloak version (Admin Console > Server info, or bin/kc.sh --version); versions older than 26.8.2 on the 26.8 line are not confirmed fixed. Also check whether any client uses UMA / Authorization Services user-managed permissions (UMA Protection API, uma_protection role); the vendor pages do not say whether it is on by default. Red Hat Build of Keycloak users: check Red Hat's advisory for their fixed build.

## Fix

Upgrade Keycloak to 26.8.2 (listed under security fixes in the 26.8.2 release notes, issue #54696). Red Hat says no mitigation is available.

## Timeline

- 2026-11-05T17:40:03+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-114232
- 2026-11-05T17:45:12+00:00 analyst https://access.redhat.com/security/cve/CVE-2026-114232 — Keycloak 26.8.2 release notes list CVE-2026-114232 (#54696) as a security fix; Red Hat page gives description, Important rating, no mitigation, reporter 0xNayel. Affected lower bound and UMA default unknown: advisory text not found; backports to older branches (26.5/26.6) not confirmed. Not exploited, no PoC seen. Did not search social posts.

## Documents

- [advisory] Red Hat CVE-2026-114232 https://access.redhat.com/security/cve/CVE-2026-114232
- [fix] Keycloak 26.8.2 release notes https://github.com/keycloak/keycloak/releases/tag/26.8.2

## From the sources

A flaw was found in the UserManagedPermissionService of the Keycloak authorization server. The UMA Protection API, which manages user permissions, fails to validate the resourceType field when a user creates a new policy. This allows an attacker to create a policy that applies to resources owned by other users, potentially leading to unauthorized access or modification of sensitive data across the entire realm.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_