Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
4.3
CVE-2026-118947: Red Hat Keycloak allows unauthorized changes to resources
CVE-2026-118947 · published 6 days ago
Summary
When remote resource management is turned on, a signed‑in user who has certain rights can modify resources they don’t own by submitting another resource’s ID. This lets the attacker change resource names, URLs or permission settings without permission. Disable remote resource management or apply the latest patch to stop the misuse.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| red hat | red hat build of keycloak | All versions |
| red hat | red hat single sign-on 7 | All versions |
Original advisory text
Keycloak-services: keycloak-services: authorization bypass via uma resource registration idor
A flaw was found in the UMA resource registration endpoint of the keycloak-services component, which provides the core logic for Keycloak's authorization and identity services. The issue occurs when remote resource management is enabled, allowing an authenticated user with specific permissions to update resources they do not own by providing a target resource ID in a request. This can lead to unauthorized modification of resource configurations, such as names, URIs, and scopes.
References
- https://access.redhat.com/security/cve/CVE-2026-118947 vdb-entry x_refsource_REDHAT
- https://bugzilla.redhat.com/show_bug.cgi?id=2563274 issue-tracking x_refsource_REDHAT
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker partial control
Type
CWE-639Authorization Bypass Through User-Controlled Key
Timeline
Published30 Oct 2026
Updated4 Nov 2026
First seen30 Oct 2026
Track software like this
Free during beta