Live › vulnerability › CVE-2026-118947
When remote resource management is enabled, a logged-in user with certain permissions can edit another owner's UMA resource by supplying its ID in a request. An attacker can change resource names, URIs and scopes, which alters what access rules apply to them.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-30 01:27 UTC. All times on this page are UTC.
Only deployments of Keycloak where remote resource management is turned on and where some users hold the permissions needed to reach the UMA resource registration endpoint are exposed. Installations with remote resource management disabled, or where only trusted administrators can register resources, are less likely to be affected. The sources do not name the exact affected versions.
No product ranges from the sources yet.
Unknown from the sources.
No fix yet, per the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
A flaw was found in the UMA resource registration endpoint of the keycloak-services component, which provides the core logic for Keycloak's authorization and identity services. The issue occurs when remote resource management is enabled, allowing an authenticated user with specific permissions to update resources they do not own by providing a target resource ID in a request. This can lead to unauthorized modification of resource configurations, such as names, URIs, and scopes.
This page as .md · .json · in your agent: get_signal("CVE-2026-118947")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.