CVE-2026-4636

HighCVSS 8.1/10Last modified Oct 26, 2026

Description

A flaw was found in Keycloak. An authenticated user with the uma_protection role can bypass User-Managed Access (UMA) policy validation. This allows the attacker to include resource identifiers owned by other users in a policy creation request, even if the URL path specifies an attacker-owned resource. Consequently, the attacker gains unauthorized permissions to victim-owned resources, enabling them to obtain a Requesting Party Token (RPT) and access sensitive information or perform unauthorized actions.

Metrics

CVSS 3.1 8.1/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Weakness enumeration

CWE-551

Affected software

VendorProductVersions
Red HatRed Hat build of Keycloak 26.2—
Red HatRed Hat build of Keycloak 26.2—
Red HatRed Hat build of Keycloak 26.2—
Red HatRed Hat build of Keycloak 26.2.15—
Red HatRed Hat build of Keycloak 26.4—
Red HatRed Hat build of Keycloak 26.4—
Red HatRed Hat build of Keycloak 26.4—
Red HatRed Hat build of Keycloak 26.4.11—
Red HatRed Hat build of Keycloak 26.2—
Red HatRed Hat build of Keycloak 26.2—
Red HatRed Hat build of Keycloak 26.2—
Red HatRed Hat build of Keycloak 26.2.15—
Red HatRed Hat build of Keycloak 26.4—
Red HatRed Hat build of Keycloak 26.4—
Red HatRed Hat build of Keycloak 26.4—
Red HatRed Hat build of Keycloak 26.4.11—

References

Timeline

Published
Apr 2, 2026
Last modified
Oct 26, 2026
NVD status
Modified

Related CVEs from 2026

CVE-2026-463605.4phpMyFAQ before 4.1.2 contains a stored cross-site scripting vulnerability in SvgSanitizer::decodeAllEntities() that limits recursive entityCVE-2026-463616.9phpMyFAQ before 4.1.2 contains a stored cross-site scripting vulnerability in search.twig where result.question and result.answerPreview areCVE-2026-463626.5phpMyFAQ before 4.1.2 contains an authorization bypass vulnerability in AbstractAdministrationController::userHasPermission() that fails to CVE-2026-463635.4phpMyFAQ before 4.1.2 contains a stored cross-site scripting vulnerability in FAQ creation and update endpoints that bypass sanitization thrCVE-2026-463649.8phpMyFAQ before 4.1.2 contains an unauthenticated SQL injection vulnerability in BuiltinCaptcha::garbageCollector() and BuiltinCaptcha::saveCVE-2026-463655.4phpMyFAQ before 4.1.2 contains a missing authorization vulnerability in the DELETE /admin/api/content/tags/{tagId} endpoint that allows any CVE-2026-463667.5phpMyFAQ before 4.1.2 contains an information disclosure vulnerability in the getIdFromSolutionId() method that lacks permission filtering, CVE-2026-463677.6phpMyFAQ before 4.1.2 contains a stored cross-site scripting vulnerability in Utils::parseUrl() that allows authenticated users to inject JaCVE-2026-463688.8luci-app-https-dns-proxy through 2025.12.29-5 — an optional LuCI web UI add-on for the https-dns-proxy package, distributed through the OpenCVE-2026-463697.5Nimiq is a Rust implementation of the Nimiq Proof-of-Stake protocol based on the Albatross consensus algorithm. Through 1.5.0, the validity CVE-2026-46375.1Paessler PRTG Network Monitor before version 26.2.120.1449 is affected by a reflected Cross-Site Scripting (XSS) vulnerability. When a requeCVE-2026-463706.5Fleet is an open-source device management platform built on osquery. In versions up to and including 4.84.1, the labels host-listing endpoin
CVE-2026-4636: High severity, CVSS 8.1 | Vulnix