Red Hat build of Keycloak UMA policy check missing lets users reach others' resources

A company login server lets users touch other people's data.

Summary

The UMA Protection API in the Red Hat build of Keycloak authorization server does not validate the resourceType field when a user creates a policy. A user can create a policy covering other users' resources and gain unauthorized access to or change sensitive data across the realm.

What to do

Update the 26.4 line to 26.4.17 and the 26.6 line to 26.6.8 or later.

Products and platforms

Linux
Red Hat build of Keycloak 26.4
Red Hat build of Keycloak 26.4.17
Red Hat build of Keycloak 26.6
Red Hat build of Keycloak 26.6.8
Red Hat Single Sign-On 7

CVE IDs

CVE-2026-114232 (opens in a new tab)

Sources

Advisory: access.redhat.com (opens in a new tab) · access.redhat.com (opens in a new tab) · access.redhat.com (opens in a new tab) · access.redhat.com (opens in a new tab)

Times

First published 2026-11-05 16:05 UTC

First seen 2026-11-09 17:00 UTC