CVE-2026-4628

Keycloak: org.keycloak.authorization: keycloak: unauthorized resource modification due to improper access control

CVSS 4.3 MEDIUMEPSS 0.2%CWE-284

Vexday Risk Score

13Bajo

Decisión SSVC (CISA)

Track

Sin señal de explotación → monitorear

CVSS 4.3EPSS 0.2%KEV nãoPoC —Nuclei —Metasploit —Patch —

Ciclo de vida

23 mar 2026Publicada en NVD

Recomendación: Monitorear — sin señal de explotación por ahora.

A flaw was found in Keycloak. An improper Access Control vulnerability in Keycloak’s User-Managed Access (UMA) resource_set endpoint allows attackers with valid credentials to bypass the allowRemoteResourceManagement=false restriction. This occurs due to incomplete enforcement of access control checks on PUT operations to the resource_set endpoint. This issue enables unauthorized modification of protected resources, impacting data integrity.

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Productos afectados

Red Hat · Red Hat Build of Keycloak Red Hat · Red Hat JBoss Enterprise Application Platform 8 Red Hat · Red Hat JBoss Enterprise Application Platform Expansion Pack Red Hat · Red Hat Single Sign-On 7

Referencias

https://access.redhat.com/security/cve/CVE-2026-4628 https://bugzilla.redhat.com/show_bug.cgi?id=2450240