All vulnerabilities
CVE-2026-4628GHSA-4pgc-gfrr-wcmg

org.keycloak:keycloak-services: Keycloak has Improper Access Control that allows attackers with valid credentials to bypass the allowRemoteResourceManagement=false

Red Hat org.keycloak:keycloak-servicesmavenIdentity & access
Open in ThreatlineRecord JSON
CVSS
4.3Medium
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.33%Chance of exploitation activity in the next 30 days, higher than 25% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed inNone listedNo source names a fixed version. Check the vendor advisory below
Published23 Mar 2026Updated 22 Oct 2026CVE List

What fixes it

No source in this snapshot names a fixed version. The vendor advisories under References are the place to check.

Description

A flaw was found in Keycloak. An improper Access Control vulnerability in Keycloak’s User-Managed Access (UMA) resource_set endpoint allows attackers with valid credentials to bypass the allowRemoteResourceManagement=false restriction. This occurs due to incomplete enforcement of access control checks on PUT operations to the resource_set endpoint. This issue enables unauthorized modification of protected resources, impacting data integrity.

Text from CVE List

Affected versions 52

  • org.keycloak:keycloak-services, maven<= 26.6.0GitHub
  • org.keycloak:keycloak-services, Mavenfrom first release, through 26.6.0OSV
  • org.keycloak:keycloak-services, Maven1.0-alpha-1OSV
  • org.keycloak:keycloak-services, Maven1.0-alpha-1-12062013OSV
  • org.keycloak:keycloak-services, Maven1.0-alpha-2OSV
  • org.keycloak:keycloak-services, Maven1.0-alpha-3OSV
  • org.keycloak:keycloak-services, Maven1.0-alpha-4OSV
  • org.keycloak:keycloak-services, Maven1.0-beta-1OSV
  • org.keycloak:keycloak-services, Maven1.0-beta-1-20150521OSV
  • org.keycloak:keycloak-services, Maven1.0-beta-1-20150523OSV
  • org.keycloak:keycloak-services, Maven1.0-beta-2OSV
  • org.keycloak:keycloak-services, Maven1.0-beta-3OSV
  • org.keycloak:keycloak-services, Maven1.0-beta-4OSV
  • org.keycloak:keycloak-services, Maven1.0-finalOSV
  • org.keycloak:keycloak-services, Maven1.0-rc-1OSV
  • org.keycloak:keycloak-services, Maven1.0-rc-2OSV
  • org.keycloak:keycloak-services, Maven1.0.1.FinalOSV
  • org.keycloak:keycloak-services, Maven1.0.2.FinalOSV
  • org.keycloak:keycloak-services, Maven1.0.3.FinalOSV
  • org.keycloak:keycloak-services, Maven1.0.4.FinalOSV
  • org.keycloak:keycloak-services, Maven1.0.5.FinalOSV
  • org.keycloak:keycloak-services, Maven1.1.0.Beta1OSV
  • org.keycloak:keycloak-services, Maven1.1.0.Beta2OSV
  • org.keycloak:keycloak-services, Maven1.1.0.FinalOSV
  • org.keycloak:keycloak-services, Maven1.1.1.FinalOSV
  • org.keycloak:keycloak-services, Maven1.2.0.Beta1OSV
  • org.keycloak:keycloak-services, Maven1.2.0.CR1OSV
  • org.keycloak:keycloak-services, Maven1.2.0.FinalOSV
  • org.keycloak:keycloak-services, Maven1.3.0.FinalOSV
  • org.keycloak:keycloak-services, Maven1.3.1.FinalOSV
  • org.keycloak:keycloak-services, Maven1.4.0.FinalOSV
  • org.keycloak:keycloak-services, Maven1.5.0-FinalOSV
  • org.keycloak:keycloak-services, Maven1.5.0.FinalOSV
  • org.keycloak:keycloak-services, Maven1.5.1.FinalOSV
  • org.keycloak:keycloak-services, Maven1.6.0.FinalOSV
  • org.keycloak:keycloak-services, Maven1.6.1.FinalOSV
  • org.keycloak:keycloak-services, Maven1.7.0.CR1OSV
  • org.keycloak:keycloak-services, Maven1.7.0.FinalOSV
  • org.keycloak:keycloak-services, Maven1.8.0.Alpha1OSV
  • org.keycloak:keycloak-services, Maven1.8.0.CR1OSV
  • org.keycloak:keycloak-services, Maven1.8.0.CR2OSV
  • org.keycloak:keycloak-services, Maven1.8.0.CR3OSV
  • org.keycloak:keycloak-services, Maven1.8.0.FinalOSV
  • org.keycloak:keycloak-services, Maven1.8.1.FinalOSV
  • org.keycloak:keycloak-services, Maven1.9.0.CR1OSV
  • org.keycloak:keycloak-services, Maven1.9.0.FinalOSV
  • org.keycloak:keycloak-services, Maven1.9.1.FinalOSV
  • org.keycloak:keycloak-services, Maven1.9.2.FinalOSV
  • org.keycloak:keycloak-services, Maven1.9.3.FinalOSV
  • org.keycloak:keycloak-services, Maven1.9.4.FinalOSV
  • org.keycloak:keycloak-services, Maven1.9.5.FinalOSV
  • org.keycloak:keycloak-services, Maven1.9.7.FinalOSV

References 5