{"id":"CVE-2026-118947","kind":"vulnerability","aliases":["CVE-2026-118947"],"related":[],"title":"Keycloak: authenticated user can change resources they do not own","description":"A flaw was found in the UMA resource registration endpoint of the keycloak-services component, which provides the core logic for Keycloak's authorization and identity services. The issue occurs when remote resource management is enabled, allowing an authenticated user with specific permissions to update resources they do not own by providing a target resource ID in a request. This can lead to unauthorized modification of resource configurations, such as names, URIs, and scopes.","summary":"When remote resource management is enabled, a logged-in user with certain permissions can edit another owner's UMA resource by supplying its ID in a request. An attacker can change resource names, URIs and scopes, which alters what access rules apply to them.","severity":"medium","cvss":4.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["authorization","keycloak","package","self-hosted"],"not_affected_if":["default-config","remote-resource-management-disabled"],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-10-30T01:16:44+00:00","first_seen_at":"2026-10-30T01:27:58+00:00","triaged_at":"2026-10-30T01:29:39+00:00","updated_at":"2026-10-30T01:29:39+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-30T01:29:39Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Keycloak: authenticated user can change resources they do not own","impact":"medium","summary":"When remote resource management is enabled, a logged-in user with certain permissions can edit another owner's UMA resource by supplying its ID in a request. An attacker can change resource names, URIs and scopes, which alters what access rules apply to them.","audience":"businesses","category":"package","nicknames":[],"who_cares":["keycloak","self-hosted","authorization"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"Authenticated user alters another owner's resource names, URIs and scopes","analyst_note":"Check the NVD entry for affected Keycloak version ranges and the upstream fixed release; the sources given do not list them.","how_to_check":"- unknown","plain_action":"","needs_analyst":true,"not_affected_if":["remote-resource-management-disabled","default-config"],"who_is_affected":"Only deployments of Keycloak where remote resource management is turned on and where some users hold the permissions needed to reach the UMA resource registration endpoint are exposed. Installations with remote resource management disabled, or where only trusted administrators can register resources, are less likely to be affected. The sources do not name the exact affected versions.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000656,"input_tokens":4158,"output_tokens":480,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-118947':9A,12A '-2026':8A,11A 'access':59B 'allow':99C 'alter':57B 'anoth':35B 'appli':61B 'attack':48B 'authent':2A,101C 'author':13B,86C 'certain':31B 'chang':5A,50B 'compon':77C 'configur':130C 'core':81C 'cve':7A,10A 'edit':34B 'enabl':24B,98C 'endpoint':71C 'flaw':63C 'found':65C 'host':18B 'id':43B,118C 'ident':88C 'issu':91C 'keycloak':1A,14B,75C,84C 'keycloak-servic':74C 'lead':124C 'log':27B 'logged-in':26B 'logic':82C 'manag':22B,96C 'modif':127C 'name':52B,133C 'occur':92C 'owner':36B 'packag':15B 'permiss':32B,105C 'provid':79C,114C 'registr':70C 'remot':20B,94C 'request':46B,121C 'resourc':6A,21B,39B,51B,69C,95C,108C,117C,129C 'rule':60B 'scope':55B,136C 'self':17B 'self-host':16B 'servic':76C,89C 'specif':104C 'suppli':41B 'target':116C 'uma':38B,68C 'unauthor':126C 'updat':107C 'uri':53B,134C 'user':3A,29B,102C","nicknames":[],"mitigations":[],"who_affected":"Only deployments of Keycloak where remote resource management is turned on and where some users hold the permissions needed to reach the UMA resource registration endpoint are exposed. Installations with remote resource management disabled, or where only trusted administrators can register resources, are less likely to be affected. The sources do not name the exact affected versions.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"first_public_at":"2026-10-30T01:16:44+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","cvss_by":"secalert@redhat.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-118947","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-118947","severity":null,"published_at":"2026-10-30T01:16:44+00:00","modified_at":"2026-10-30T01:16:44+00:00","first_seen_at":"2026-10-30T01:27:58+00:00","fetched_at":"2026-10-30T01:27:58+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}