CVE-2026-4636
High · 8.1CVSS
8.1
EPSS
0.5%
Published
Apr 2, 2026
CISA due date
—
The record
A flaw was found in Keycloak. An authenticated user with the uma_protection role can bypass User-Managed Access (UMA) policy validation. This allows the attacker to include resource identifiers owned by other users in a policy creation request, even if the URL path specifies an attacker-owned resource. Consequently, the attacker gains unauthorized permissions to victim-owned resources, enabling them to obtain a Requesting Party Token (RPT) and access sensitive information or perform unauthorized actions.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-106579 ImageMagick is free and open-source software used for editing and manipulating digital… CWE-551
- CVE-2026-16102 A flaw was found in the Dynamic Client Registration (DCR) component of Keycloak, an… CWE-551
- CVE-2026-15573 A flaw was found in Keycloak's Authorization Services. CWE-551
- CVE-2026-13676 fast-uri versions 2.3.1 through 3.1.2 and 4.0.0 fail to canonicalize Unicode (IDN)… CWE-551
- CVE-2026-57920 Peplink InControl 2 through 2.14.2 before 2026-06-03 allows use of a semicolon to bypass… CWE-551
- CVE-2026-50559 Quarkus is a Java framework for building cloud-native applications. CWE-551
- CVE-2026-44574 Next.js is a React framework for building full-stack web applications. CWE-551
- CVE-2026-44575 Next.js is a React framework for building full-stack web applications. CWE-551