VULNERABILITY INTELLIGENCE

CVE-2026-4628

CVSS score4.3 MEDIUM
EPSS probability0.26%
CISA KEVNot currently listed
Published2026-03-23
Last modified2026-10-22
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Description

A flaw was found in Keycloak. An improper Access Control vulnerability in Keycloak’s User-Managed Access (UMA) resource_set endpoint allows attackers with valid credentials to bypass the allowRemoteResourceManagement=false restriction. This occurs due to incomplete enforcement of access control checks on PUT operations to the resource_set endpoint. This issue enables unauthorized modification of protected resources, impacting data integrity.

Weakness classification

  • secalert@redhat.com: CWE-284

Primary references