CVE-2026-4628

MediumCVSS 4.3/10Last modified Oct 22, 2026

Description

A flaw was found in Keycloak. An improper Access Control vulnerability in Keycloak’s User-Managed Access (UMA) resource_set endpoint allows attackers with valid credentials to bypass the allowRemoteResourceManagement=false restriction. This occurs due to incomplete enforcement of access control checks on PUT operations to the resource_set endpoint. This issue enables unauthorized modification of protected resources, impacting data integrity.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-284

Affected software

VendorProductVersions
Red HatRed Hat build of Keycloak 26.4.12—
Red HatRed Hat Build of Keycloak—
Red HatRed Hat JBoss Enterprise Application Platform 8—
Red HatRed Hat JBoss Enterprise Application Platform Expansion Pack—
Red HatRed Hat Single Sign-On 7—

References

Timeline

Published
Mar 23, 2026
Last modified
Oct 22, 2026
NVD status
Modified

Related CVEs from 2026

CVE-2026-462807.8In the Linux kernel, the following vulnerability has been resolved: lib: test_hmm: evict device pages on file close to avoid use-after-freeCVE-2026-462817.8In the Linux kernel, the following vulnerability has been resolved: vmalloc: fix buffer overflow in vrealloc_node_align() Commit 4c5d33658CVE-2026-462825.5In the Linux kernel, the following vulnerability has been resolved: iio: frequency: admv1013: fix NULL pointer dereference on str When devCVE-2026-462835.5In the Linux kernel, the following vulnerability has been resolved: tpm: Use kfree_sensitive() to free auth session in tpm_dev_release() tCVE-2026-462845.5In the Linux kernel, the following vulnerability has been resolved: mm/hugetlb: fix early boot crash on parameters without '=' separator ICVE-2026-462857.8In the Linux kernel, the following vulnerability has been resolved: mtd: docg3: fix use-after-free in docg3_release() In docg3_release(), CVE-2026-462865.5In the Linux kernel, the following vulnerability has been resolved: leds: qcom-lpg: Check for array overflow when selecting the high resoluCVE-2026-462875.5In the Linux kernel, the following vulnerability has been resolved: net: txgbe: fix RTNL assertion warning when remove module For the coppCVE-2026-462888.4In the Linux kernel, the following vulnerability has been resolved: of: unittest: fix use-after-free in of_unittest_changeset() The variabCVE-2026-462899.8In the Linux kernel, the following vulnerability has been resolved: lib/scatterlist: fix length calculations in extract_kvec_to_sg Patch sCVE-2026-46296.5A flaw was found in Keycloak. A highly privileged user with `manage-clients` permission can exploit this vulnerability by injecting a hardcoCVE-2026-462905.5In the Linux kernel, the following vulnerability has been resolved: x86/efi: Fix graceful fault handling after FPU softirq changes Since c
CVE-2026-4628: Medium severity, CVSS 4.3 | Vulnix