Keycloak: UMA Protection API authorization bypass (CVE-2026-114232)
An authorization bypass vulnerability in the Keycloak UserManagedPermissionService allows authenticated attackers to create policies for resources owned by other users due to insufficient validation of the resourceType field.
CVE search metadata
CVE search record: CVE-2026-114232. Severity: high. CVSS: 8.1. KEV: no. Product: Keycloak. Brief: Keycloak: UMA Protection API authorization bypass (CVE-2026-114232). Brief link: https://feed.craftedsignal.io/briefs/2026-11-keycloak-authorization-bypass/
Triage facts
Revision 1- Applicability
- Keycloak
- Evidence
- Unknown
- Severity
- High
- Action
- Elevated
- Sources
- 1 public source
- Freshness
- Revision 1Nov 5, 18:23 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- A1Likely
A security flaw (CVE-2026-114232) exists in the UserManagedPermissionService component of the Keycloak authorization server. The UMA Protection API fails to validate the 'resourceType' field when processing policy creation requests. This oversight allows an authenticated user to create policies targeting resources they do not own, potentially enabling unauthorized access to or modification of sensitive data within the same realm.
Impact
The vulnerability allows authenticated users to escalate privileges by manipulating access control policies. This could lead to unauthorized access to, or modification of, resources managed by other users within the Keycloak environment.
Recommendation
- Inventory all Keycloak instances within the organization to identify versions utilizing the vulnerable UserManagedPermissionService.
- Monitor the Keycloak authorization server logs for unusual API call patterns related to UMA policy creation.
- Prioritize the application of vendor-supplied patches as soon as they become available to address this authorization logic flaw.
Immediate actions
Audit Keycloak realm configurations and logs for unauthorized policy creation attempts targeting cross-user resources
Threat Hunt
Identify unusual spikes in API requests to the UMA Protection endpoint
Data: Keycloak server access logs, Authorization audit logs
Mitigations
Monitor Keycloak vendor security portal for the patch release addressing CVE-2026-114232
CVE-2026-114232