Cve-2026-114232 - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/tags/cve-2026-114232/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioThu, 05 Nov 2026 18:23:09 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgKeycloak: UMA Protection API authorization bypass (CVE-2026-114232)https://feed.craftedsignal.io/briefs/2026-11-keycloak-authorization-bypass/Thu, 05 Nov 2026 18:23:09 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-11-keycloak-authorization-bypass/An authorization bypass vulnerability in the Keycloak UserManagedPermissionService allows authenticated attackers to create policies for resources owned by other users due to insufficient validation of the resourceType field.A security flaw (CVE-2026-114232) exists in the UserManagedPermissionService component of the Keycloak authorization server. The UMA Protection API fails to validate the 'resourceType' field when processing policy creation requests. This oversight allows an authenticated user to create policies targeting resources they do not own, potentially enabling unauthorized access to or modification of sensitive data within the same realm.

Impact

The vulnerability allows authenticated users to escalate privileges by manipulating access control policies. This could lead to unauthorized access to, or modification of, resources managed by other users within the Keycloak environment.

Recommendation

  • Inventory all Keycloak instances within the organization to identify versions utilizing the vulnerable UserManagedPermissionService.
  • Monitor the Keycloak authorization server logs for unusual API call patterns related to UMA policy creation.
  • Prioritize the application of vendor-supplied patches as soon as they become available to address this authorization logic flaw.
]]>highadvisorycve-2026-114232authorization-bypasskeycloakweb-application