{"id":"CVE-2026-4628","kind":"vulnerability","aliases":["CVE-2026-4628","GHSA-4pgc-gfrr-wcmg"],"related":[],"title":"Keycloak has Improper Access Control that allows attackers with valid credentials to bypass the allowRemoteResourceManagement=false","description":"A flaw was found in Keycloak. An improper Access Control vulnerability in Keycloak’s User-Managed Access (UMA) resource_set endpoint allows attackers with valid credentials to bypass the allowRemoteResourceManagement=false restriction. This occurs due to incomplete enforcement of access control checks on PUT operations to the resource_set endpoint. This issue enables unauthorized modification of protected resources, impacting data integrity.","summary":"Keycloak's User-Managed Access resource_set endpoint does not fully enforce the allowRemoteResourceManagement=false restriction on PUT requests. An attacker with valid credentials can modify protected resources, which affects data integrity.","severity":"medium","cvss":4.300000190734863,"epss":0.002749999985098839,"exploited":false,"exploited_at":null,"products":[{"name":"org.keycloak:keycloak-services","fixed":[],"affected":"<= 26.6.0","ecosystem":"maven"},{"name":"redhat build of keycloak","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["maven","vendor"],"tags":["cwe-284","java","keycloak","runtime","self-hosted","uma"],"not_affected_if":["remote-resource-management-not-restricted","uma-not-used"],"how_to_check":"Check whether any realm client's UMA resource server sets allowRemoteResourceManagement to false and whether the UMA resource_set endpoint is in use. Check the running Keycloak version against maven org.keycloak:keycloak-services <= 26.6.0.","fix":"Upgrade to a Keycloak release newer than 26.6.0; the fixed version is unknown from the sources.","status":"open","published_at":"2026-03-23T09:16:26+00:00","first_seen_at":"2026-10-23T19:11:31+00:00","triaged_at":"2026-10-23T21:49:11+00:00","updated_at":"2026-10-23T23:44:52+00:00","category":"runtime","confidence":0.7,"triage":{"at":"2026-10-23T21:49:11Z","model":"claude-haiku-5-5","output":{"fix":"Upgrade to a Keycloak release newer than 26.6.0; the fixed version is unknown from the sources.","reach":"unknown","impact":"medium","summary":"Keycloak's User-Managed Access resource_set endpoint does not fully enforce the allowRemoteResourceManagement=false restriction on PUT requests. An attacker with valid credentials can modify protected resources, which affects data integrity.","category":"runtime","who_cares":["keycloak","uma","self-hosted","java"],"confidence":0.7,"needs_auth":"yes","worst_case":"Authenticated attacker modifies protected UMA resources despite remote management restriction","analyst_note":"","how_to_check":"Check whether any realm client's UMA resource server sets allowRemoteResourceManagement to false and whether the UMA resource_set endpoint is in use. Check the running Keycloak version against maven org.keycloak:keycloak-services <= 26.6.0.","needs_analyst":false,"not_affected_if":["uma-not-used","remote-resource-management-not-restricted"],"user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000975,"input_tokens":2916,"output_tokens":1366,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':18A,26A '-284':37B '-4628':19A,27A '4pgc':22A 'access':4A,50B,86C,95C,118C 'affect':75B 'allow':7A,100C 'allowremoteresourcemanag':15A,59B,108C 'attack':8A,66B,101C 'build':33A 'bypass':13A,106C 'check':120C 'control':5A,87C,119C 'credenti':11A,69B,104C 'cve':17A,25A 'cwe':36B 'data':76B,138C 'due':113C 'enabl':131C 'endpoint':53B,99C,128C 'enforc':57B,116C 'fals':16A,60B,109C 'flaw':79C 'found':81C 'fulli':56B 'gfrr':23A 'ghsa':21A 'ghsa-4pgc-gfrr-wcmg':20A 'host':43B 'impact':137C 'improp':3A,85C 'incomplet':115C 'integr':77B,139C 'issu':130C 'java':38B 'keycloak':1A,30A,35A,39B,45B,83C,90C 'keycloak-services':29A 'manag':49B,94C 'modif':133C 'modifi':71B 'occur':112C 'of':34A 'oper':123C 'org.keycloak':28A 'protect':72B,135C 'put':63B,122C 'redhat':32A 'request':64B 'resourc':51B,73B,97C,126C,136C 'restrict':61B,110C 'runtim':40B 'self':42B 'self-host':41B 'services':31A 'set':52B,98C,127C 'uma':44B,96C 'unauthor':132C 'user':48B,93C 'user-manag':47B,92C 'valid':10A,68B,103C 'vulner':88C 'wcmg':24A","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2026-03-23T09:16:26+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","cvss_by":"GitHub","poc_count":0,"sources":[{"source":"ghsa","external_id":"GHSA-4pgc-gfrr-wcmg","url":"https://github.com/advisories/GHSA-4pgc-gfrr-wcmg","severity":"medium","published_at":"2026-03-23T09:30:30+00:00","modified_at":"2026-10-22T21:32:00+00:00","first_seen_at":"2026-10-23T19:11:31+00:00","fetched_at":"2026-10-23T19:11:31+00:00","note":null},{"source":"nvd","external_id":"CVE-2026-4628","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-4628","severity":null,"published_at":"2026-03-23T09:16:26+00:00","modified_at":"2026-10-22T21:17:18+00:00","first_seen_at":"2026-10-23T23:44:52+00:00","fetched_at":"2026-10-23T23:44:52+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}