Keycloak IDOR Vulnerability in Admin API Authorization Resource Management

An IDOR (Insecure Direct Object Reference) vulnerability has been identified in Keycloak's admin API endpoints for managing authorization resources. This issue, present in the ResourceSetService and PermissionTicketService, arises because the system authorizes requests based on the resourceServer (client) ID, while the database operations for finding and deleting resources only consider the resourceId. As a result, an authenticated attacker with fine-grained admin rights for one client can manipulate resources of another client within the same realm by using a valid resource ID.

Impact

Exploitation of this vulnerability allows an authenticated attacker to delete or update authorization resources belonging to different clients within the same realm, potentially disrupting access control management.