Keycloak-services: keycloak-services: authorization bypass via uma resource registration idor

Özet

Türkçe özeti yalnızca kritik ve yüksek önemdeki açıklar için hazırlıyoruz. Bu açık için kaynağın kendi açıklamasını gösteriyoruz.

A flaw was found in the UMA resource registration endpoint of the keycloak-services component, which provides the core logic for Keycloak's authorization and identity services. The issue occurs when remote resource management is enabled, allowing an authenticated user with specific permissions to update resources they do not own by providing a target resource ID in a request. This can lead to unauthorized modification of resource configurations, such as names, URIs, and scopes.

Etkilenen sürümler2 yazılım

Kaynaklar4 kaynak

• CVE.org kaydı
• NVD kaydı
• bugzilla.redhat.com/show_bug.cgi Üçüncü taraf
• access.redhat.com/security/cve/CVE-2026-118947 Diğer

Kayıt geçmişi

1. 30 Eki 2026 03:13Yayımlandı

İlgili açıklar

• 6,5 CVE-2026-91920Undertow: undertow: chunkreader message length permits chunk-size overflow
• 5,4 CVE-2026-118959Keycloak-services: keycloak-services: required actions bypassed via kc_action parameter
• 6,8 CVE-2026-118425Keycloak-services: keycloak-services: redirect uri domain allowlist bypass via dns resolution to loopback
• 5,4 CVE-2026-117859Keycloak-services: keycloak-services: par single-use bypass via flow restart
• 4,2 CVE-2026-118030Keycloak-services: keycloak-services: hotp race condition allows single otp code reuse across concurrent logins
• 5,3 CVE-2026-117688Keycloak-services: keycloak-services: vault secret disclosure via client registration installation configuration