---
id: "CVE-2026-118947"
kind: "vulnerability"
aliases: ["CVE-2026-118947"]
title: "Keycloak: authenticated user can change resources they do not own"
severity: "medium"
cvss: 4.3
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["authorization", "keycloak", "package", "self-hosted"]
not_affected_if: ["default-config", "remote-resource-management-disabled"]
published_at: "2026-10-30T01:16:44+00:00"
first_seen_at: "2026-10-30T01:27:58+00:00"
updated_at: "2026-10-30T01:29:39+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-118947", "first_seen_at": "2026-10-30T01:27:58+00:00"}]
---

# Keycloak: authenticated user can change resources they do not own

When remote resource management is enabled, a logged-in user with certain permissions can edit another owner's UMA resource by supplying its ID in a request. An attacker can change resource names, URIs and scopes, which alters what access rules apply to them.

_Summary, check and fix written by a model from the sources; labelled as such._

## Timeline

- 2026-10-30T01:27:58+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-118947

## From the sources

A flaw was found in the UMA resource registration endpoint of the keycloak-services component, which provides the core logic for Keycloak's authorization and identity services. The issue occurs when remote resource management is enabled, allowing an authenticated user with specific permissions to update resources they do not own by providing a target resource ID in a request. This can lead to unauthorized modification of resource configurations, such as names, URIs, and scopes.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_