{"id":"CVE-2026-4628","aliases":["GHSA-4pgc-gfrr-wcmg"],"title":"Keycloak has Improper Access Control that allows attackers with valid credentials to bypass the allowRemoteResourceManagement=false","summary":"Keycloak has Improper Access Control that allows attackers with valid credentials to bypass the allowRemoteResourceManagement=false","severity":"medium","cvss":4.3,"cwe":["CWE-284"],"vendor":"keycloak","product":"org.keycloak:keycloak-services","ecosystem":"maven","affected":["org.keycloak:keycloak-services <= 26.6.0"],"published":"2026-03-23","updated":"2026-10-22","sourceUpdated":"2026-10-22T21:32:00Z","source":"GHSA","sourceUrl":"https://github.com/advisories/GHSA-4pgc-gfrr-wcmg","references":[{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-4628"},{"url":"https://access.redhat.com/security/cve/CVE-2026-4628"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2450240"},{"url":"https://access.redhat.com/errata/RHSA-2026:19596"},{"url":"https://github.com/advisories/GHSA-4pgc-gfrr-wcmg"}],"tags":["ghsa","maven","cve.org"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-03-25T14:02:51.761138Z"},"epss":0.00275,"epssPercentile":0.18842,"ingestedAt":"2026-10-22T22:00:50.248Z","slug":"CVE-2026-4628","body":"## Overview\n\nA flaw was found in Keycloak. An improper Access Control vulnerability in Keycloak’s User-Managed Access (UMA) resource_set endpoint allows attackers with valid credentials to bypass the allowRemoteResourceManagement=false restriction. This occurs due to incomplete enforcement of access control checks on PUT operations to the resource_set endpoint. This issue enables unauthorized modification of protected resources, impacting data integrity.\n\n## Affected packages\n\n- `org.keycloak:keycloak-services <= 26.6.0`\n\n## Remediation\n\nRefer to the advisory for the patched release.","depth":"sunlit","depthScore":24,"depthScoreParts":{"impact":23.7,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}