A flaw was found in Keycloak. An authenticated user with the uma_protection role can bypass User-Managed Access (UMA) policy validation. This allows the attacker to include resource identifiers owned by other users in a policy creation request, even if the URL path specifies an attacker-owned resource. Consequently, the attacker gains unauthorized permissions to victim-owned resources, enabling them to obtain a Requesting Party Token (RPT) and access sensitive information or perform unauthorized actions.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - A flaw was found in Keycloak. An authenticated user with the uma_protection role can bypass User-Managed
    Access (UMA) policy validation. This allows the attacker to include resource identifiers owned by other
    users in a policy creation request, even if the URL path specifies an attacker-owned resource.
    Consequently, the attacker gains unauthorized permissions to victim-owned resources, enabling them to
    obtain a Requesting Party Token (RPT) and access sensitive information or perform unauthorized actions.
    (CVE-2026-4636)

ID	Name	Product	Family	Type	Severity
462560	Echo: keycloak-25: security update to 25.0.6+e1org.keycloak:keycloak-services: security update to 26.5.7	Tenable Cloud Security	Echo Local Security Checks	Local	high
462560	Echo: keycloak-25: security update to 25.0.6+e1org.keycloak:keycloak-services: security update to 26.5.7	Tenable Self-Hosted Container Security	Echo Local Security Checks	Local	high
439853	SCA: security update for org.keycloak:keycloak-services (GHSA-f2hx-5fx3-hmcv)	Tenable Cloud Security	SCA Checks	Local	high
439853	SCA: security update for org.keycloak:keycloak-services (GHSA-f2hx-5fx3-hmcv)	Tenable Self-Hosted Container Security	SCA Checks	Local	high

Detections

Analytics

CVE-2026-4636

high

Tenable Plugins

high

high

high

high