Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
5.4

Keycloak Allows Privileged Users to Modify Other Users' Resources

CVE-2025-14778 · published 8 months ago
Summary

Keycloak's UserManagedPermissionService in the UMA Protection API has a security flaw that allows a user to modify other users' resources. This means a user with permission to edit one resource can also edit permissions for other resources owned by different users. To protect your Keycloak instance, update to the latest version of Keycloak and ensure all users have the correct permissions set.

What to do
  • Update keycloak org.keycloak:keycloak-services to version 26.2.13.
  • Update keycloak org.keycloak:keycloak-services to version 26.5.3.
  • Update keycloak org.keycloak:keycloak-services to version 26.4.9.
Affected software
Ecosystem VendorProductAffected versions
maven keycloak org.keycloak:keycloak-services < 26.2.13
>= 26.5.0, < 26.5.3
>= 26.3.0, < 26.4.9
Fix: upgrade to 26.2.13
Original advisory text
Keycloak Affected by Broken Access Control Vulnerability in the UserManagedPermissionService
A flaw was found in Keycloak. A significant Broken Access Control vulnerability exists in the UserManagedPermissionService (UMA Protection API). When updating or deleting a UMA policy associated with multiple resources, the authorization check only verifies the caller's ownership against the first resource in the policy's list. This allows a user (Owner A) who owns one resource (RA) to update a shared policy and modify authorization rules for other resources (e.g., RB) in that same policy, even if those other resources are owned by a different user (Owner B). This constitutes a horizontal privilege escalation.
References
Fix within
Internet-facing 60 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker partial control
Severity
5.4 Medium
Exploitation
<1% chance of attack within 30 days
Type
CWE-266Incorrect Privilege Assignment
Timeline
Published9 Feb 2026
Updated4 Nov 2026
First seen6 Mar 2026
Sources
CVE-2025-14778 · NVD
GHSA-fm6w-rrp3-2x4w · GHSA
Track software like this
Free during beta