Keycloak: incorrect ownership checks in /uma-policy/
Vulnerability Description
A flaw was found in Keycloak. A significant Broken Access Control vulnerability exists in the UserManagedPermissionService (UMA Protection API). When updating or deleting a UMA policy associated with multiple resources, the authorization check only verifies the caller's ownership against the first resource in the policy's list. This allows a user (Owner A) who owns one resource (RA) to update a shared policy and modify authorization rules for other resources (e.g., RB) in that same policy, even if those other resources are owned by a different user (Owner B). This constitutes a horizontal privilege escalation.
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-14778
Credits & Attribution
The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:
- Red Hat would like to thank Joshua Rogers for reporting this issue.
References
More from Red Hat
View All →Affected Vendor
Red Hat
View all reports →