A flaw exists in Keycloak’s User‑Managed Access (UMA) resource_set endpoint that allows an authenticated attacker to bypass the allowRemoteResourceManagement=false restriction. The vulnerability arises from incomplete enforcement of access control checks on PUT operations, enabling an attacker with valid credentials to modify protected resources. This results in unauthorized changes that compromise data integrity and stems from an improper access control weakness (CWE‑284).

The vulnerability affects Red Hat products including Red Hat Build of Keycloak, Red Hat JBoss Enterprise Application Platform 8, Red Hat JBoss Enterprise Application Platform Expansion Pack, and Red Hat Single Sign‑On 7. Specific version details are not specified in the CNA data; administrators should review all deployed instances of these products for potential exposure.

The CVSS score of 4.3 indicates moderate severity, while the EPSS score of less than 1% suggests a low likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog. The attack vector is inferred: an attacker who authenticates to Keycloak can issue a PUT request to the resource_set endpoint and alter resources regardless of the configured restriction. No public patch or workaround is currently available, increasing risk for systems that have not applied an official security update.