CVE-2026-4628 | BDVDB-2026-322011 Detail

Description#

A flaw was found in Keycloak. An improper Access Control vulnerability in Keycloak’s User-Managed Access (UMA) resource_set endpoint allows attackers with valid credentials to bypass the allowRemoteResourceManagement=false restriction. This occurs due to incomplete enforcement of access control checks on PUT operations to the resource_set endpoint. This issue enables unauthorized modification of protected resources, impacting data integrity.

Impact#

Weaknesses#

References#

Exploit#

History#

1. Version 12026-03-23Record published in the CVE List.
2. Version 22026-10-22Most recent update recorded in the CVE List.