CVE-2026-4628Medium· 4.3▾ SunlitKeycloak has Improper Access Control that allows attackers with valid credentials to bypass the allowRemoteResourceManagement=false
▾ Sunlit zone — Low / medium · no exploitation signal
impact 23.7 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via GHSA
Last analysed / modified upstream
0.3%
A flaw was found in Keycloak. An improper Access Control vulnerability in Keycloak’s User-Managed Access (UMA) resource_set endpoint allows attackers with valid credentials to bypass the allowRemoteResourceManagement=false restriction. This occurs due to incomplete enforcement of access control checks on PUT operations to the resource_set endpoint. This issue enables unauthorized modification of protected resources, impacting data integrity.
org.keycloak:keycloak-services <= 26.6.0Refer to the advisory for the patched release.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-4633Low· 3.7Keycloak's identity-first login flow exposes user information
CVE-2026-37980Medium· 6.9Keycloak: Arbitrary code execution via Stored Cross-Site Scripting (XSS) in organization selection login page
CVE-2026-9795High· 7.3Keycloak has privilege escalation via improper scope mapping enforcement
GHSA-wmxr-6j5f-838pHigh· 7.7Duplicate Advisory: Keycloak: Unauthorized access via improper validation of encrypted SAML assertions
CVE-2026-90997High· 7.4A flaw was found in Keycloak
CVE-2025-10070Medium· 6.3Portabilis i-Educar enturmacao-em-lote access control