ALT-PU-2026-4227: package keycloak update to version 26.5.5-alt1
Описание
This update upgrades keycloak to version 26.5.5-alt1.
Устраненные уязвимости14
Ссылки12
GHSA-37gf-gmxv-74wv
https://github.com/advisories/GHSA-37gf-gmxv-74wvGHSA-63v5-26vq-m4vm
https://github.com/advisories/GHSA-63v5-26vq-m4vmGHSA-794g-x443-36f7
https://github.com/advisories/GHSA-794g-x443-36f7GHSA-8cr3-vpxx-92cx
https://github.com/advisories/GHSA-8cr3-vpxx-92cxGHSA-fjf4-6f34-w64q
https://github.com/advisories/GHSA-fjf4-6f34-w64qGHSA-fm6w-rrp3-2x4w
https://github.com/advisories/GHSA-fm6w-rrp3-2x4wGHSA-gv94-wp4h-vv8p
https://github.com/advisories/GHSA-gv94-wp4h-vv8pGHSA-hcvw-475w-8g7p
https://github.com/advisories/GHSA-hcvw-475w-8g7pGHSA-m297-3jv9-m927
https://github.com/advisories/GHSA-m297-3jv9-m927GHSA-x4p7-7chp-64hq
https://github.com/advisories/GHSA-x4p7-7chp-64hqGHSA-xv6h-r36f-3gp5
https://github.com/advisories/GHSA-xv6h-r36f-3gp5Связанные уязвимости
ALT-PU-2026-4903: package `keycloak` update to version 26.5.6-alt1
A flaw was found in Keycloak. A significant Broken Access Control vulnerability exists in the UserManagedPermissionService (UMA Protection API). When updating or deleting a UMA policy associated with multiple resources, the authorization check only verifies the caller's ownership against the first resource in the policy's list. This allows a user (Owner A) who owns one resource (RA) to update a shared policy and modify authorization rules for other resources (e.g., RB) in that same policy, even if those other resources are owned by a different user (Owner B). This constitutes a horizontal privilege escalation.
A flaw was found in Keycloak. A significant Broken Access Control vulnerability exists in the UserManagedPermissionService (UMA Protection API). When updating or deleting a UMA policy associated with multiple resources, the authorization check only verifies the caller's ownership against the first resource in the policy's list. This allows a user (Owner A) who owns one resource (RA) to update a shared policy and modify authorization rules for other resources (e.g., RB) in that same policy, even if those other resources are owned by a different user (Owner B). This constitutes a horizontal privilege escalation.
A flaw was found in Keycloak. A significant Broken Access Control vuln ...
Keycloak Affected by Broken Access Control Vulnerability in the UserManagedPermissionService