Поиск уязвимостей
Количество 7
Количество 7
GHSA-f2hx-5fx3-hmcv
Keycloak: UMA Policy Resource Injection Allows Unauthorized Cross-User Permission Grants
CVE-2026-4636
A flaw was found in Keycloak. An authenticated user with the uma_protection role can bypass User-Managed Access (UMA) policy validation. This allows the attacker to include resource identifiers owned by other users in a policy creation request, even if the URL path specifies an attacker-owned resource. Consequently, the attacker gains unauthorized permissions to victim-owned resources, enabling them to obtain a Requesting Party Token (RPT) and access sensitive information or perform unauthorized actions.
CVE-2026-4636
A flaw was found in Keycloak. An authenticated user with the uma_protection role can bypass User-Managed Access (UMA) policy validation. This allows the attacker to include resource identifiers owned by other users in a policy creation request, even if the URL path specifies an attacker-owned resource. Consequently, the attacker gains unauthorized permissions to victim-owned resources, enabling them to obtain a Requesting Party Token (RPT) and access sensitive information or perform unauthorized actions.
CVE-2026-4636
A flaw was found in Keycloak. An authenticated user with the uma_prote ...
BDU:2026-05926
Уязвимость программного средства для управления идентификацией и доступом Keycloak, связанная с некорректным порядком поведения, позволяющая нарушителю получить несанкционированный доступ к конфиденциальной информации
ALT-PU-2026-6040
ALT-PU-2026-6040: package `keycloak` update to version 26.5.7-alt1
ALT-PU-2026-5671
ALT-PU-2026-5671: package `keycloak` update to version 26.5.7-alt1
Уязвимостей на страницу
Уязвимость | CVSS | EPSS | Опубликовано | |
|---|---|---|---|---|
| GHSA-f2hx-5fx3-hmcv Keycloak: UMA Policy Resource Injection Allows Unauthorized Cross-User Permission Grants | CVSS3: 8.1 | 0% Низкий | 7 месяцев назад |
 | CVE-2026-4636 A flaw was found in Keycloak. An authenticated user with the uma_protection role can bypass User-Managed Access (UMA) policy validation. This allows the attacker to include resource identifiers owned by other users in a policy creation request, even if the URL path specifies an attacker-owned resource. Consequently, the attacker gains unauthorized permissions to victim-owned resources, enabling them to obtain a Requesting Party Token (RPT) and access sensitive information or perform unauthorized actions. | CVSS3: 8.1 | 0% Низкий | 7 месяцев назад |
 | CVE-2026-4636 A flaw was found in Keycloak. An authenticated user with the uma_protection role can bypass User-Managed Access (UMA) policy validation. This allows the attacker to include resource identifiers owned by other users in a policy creation request, even if the URL path specifies an attacker-owned resource. Consequently, the attacker gains unauthorized permissions to victim-owned resources, enabling them to obtain a Requesting Party Token (RPT) and access sensitive information or perform unauthorized actions. | CVSS3: 8.1 | 0% Низкий | 7 месяцев назад |
| CVE-2026-4636 A flaw was found in Keycloak. An authenticated user with the uma_prote ... | CVSS3: 8.1 | 0% Низкий | 7 месяцев назад |
 | BDU:2026-05926 Уязвимость программного средства для управления идентификацией и доступом Keycloak, связанная с некорректным порядком поведения, позволяющая нарушителю получить несанкционированный доступ к конфиденциальной информации | CVSS3: 8.1 | 0% Низкий | 8 месяцев назад |
| ALT-PU-2026-6040 ALT-PU-2026-6040: package `keycloak` update to version 26.5.7-alt1 | CVSS3: 8.1 | 7 месяцев назад | |
| ALT-PU-2026-5671 ALT-PU-2026-5671: package `keycloak` update to version 26.5.7-alt1 | CVSS3: 8.1 | 7 месяцев назад |
Уязвимостей на страницу