An authenticated user with the uma_protection role can bypass Keycloak’s User‑Managed Access policy validation. The attacker can request the creation of a policy that references resources belonging to other users, even when the request’s URL points to an attacker‑owned resource. If successful, the attacker receives a Requesting Party Token that grants them unauthorized access to the victim’s protected resources, permitting disclosure of sensitive data or execution of unauthorized operations.

Red Hat builds of Keycloak 26.2 (up through 26.2.15) and 26.4 (up through 26.4.11) are vulnerable. The affected packages are identified in Red Hat Composite Package Sets 26.2 and 26.4 for Enterprise Linux 9, as listed in the advisory.

The CVSS score is 8.1, indicating high severity. EPSS data is not available, and the vulnerability is currently not listed in the CISA KEV catalog. Because the flaw requires an authenticated user with a specific role, the attack vector is internal or within a compromised user session. Nonetheless, the impact is significant—unauthorized access to protected resources—so the risk remains high if the vulnerability is not patched.