Yüksek CVSS 8.1 PoC var
CVE-2026-4636: Build Of Keycloak: güvenlik açığı
Açıklama (NVD)
A flaw was found in Keycloak. An authenticated user with the uma_protection role can bypass User-Managed Access (UMA) policy validation. This allows the attacker to include resource identifiers owned by other users in a policy creation request, even if the URL path specifies an attacker-owned resource. Consequently, the attacker gains unauthorized permissions to victim-owned resources, enabling them to obtain a Requesting Party Token (RPT) and access sensitive information or perform unauthorized actions.
Özet bilgiler
- Ürün
- Redhat Build Of Keycloak
- CVSS v3.1
- 8.1
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N - EPSS
- %0,44 (yüzdelik 38)
- CWE
- CWE-551
- Yama
- Yok / bilinmiyor
Etkilenen sürümler
| Ürün | Başlangıç | Bitiş | Düzeltildi |
|---|---|---|---|
| redhat-build-of-keycloak | — | — | — |
| redhat-build-of-keycloak | 26.2 | 26.2 | — |
| redhat-build-of-keycloak | 26.2.15 | 26.2.15 | — |
| redhat-build-of-keycloak | 26.4 | 26.4 | — |
| redhat-build-of-keycloak | 26.4.11 | 26.4.11 | — |