A broken access control flaw in Keycloak allows an authenticated attacker with administrative privileges on a single client to delete or modify authorization resources belonging to a different client within the same realm. The vulnerability arises because the admin API endpoints for resource and permission ticket management validate the client ID provided in the request but perform database lookup and modification solely on the resource ID, creating an IDOR condition. This leads to unintended privilege escalation and unauthorized alteration of resource definitions.

The affected products are the Red Hat build of Keycloak 26.4 and 26.4.11 deployed on Enterprise Linux 9, where the admin API is exposed.

The CVSS score is 6, indicating a moderate impact. The EPSS score is less than 1%, meaning the probability of exploitation is very low, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is an authenticated user with fine‑grained client admin rights who sends API requests to ResourceSetService or PermissionTicketService with the resource ID of another client’s resource. Because only the resource ID is checked for deletion or update, the attacker can delete or modify resources belonging to a separate client in the same realm.