Keycloak Broken Access Control Vulnerability in UserManagedPermissionService

A significant broken access control vulnerability has been identified in Keycloak's UserManagedPermissionService, part of the UMA Protection API. This vulnerability allows a user (Owner A) who owns one resource to update a shared policy and alter authorization rules for other resources in that policy, even if those resources are owned by a different user (Owner B). The issue arises because the authorization check only verifies ownership against the first resource in the policy's list, leading to horizontal privilege escalation.

Impact

Exploitation of this vulnerability allows for unauthorized modification of UMA policies, enabling users to change authorization rules for resources they do not own.

Remediation

Users can upgrade to the Red Hat build of Keycloak 26.2.13 or 26.4.9, both of which include the necessary fix. Instructions for downloading these versions are available on the Red Hat Customer Portal.