Keycloak Improper Access Control Vulnerability in User-Managed Access Resource Set Endpoint

An improper access control vulnerability has been identified in Keycloak's User-Managed Access (UMA) resource_set endpoint. This flaw allows authenticated attackers to bypass the allowRemoteResourceManagement=false restriction, enabling unauthorized modifications of protected resources. The issue arises from incomplete enforcement of access control checks on PUT operations to the resource_set endpoint, impacting data integrity.

Impact

Exploitation of this vulnerability allows authenticated users to make unauthorized changes to protected resources, thereby compromising data integrity.