CVE-2026-3190

Katalog CVE

CVSS 4.3 · Medium EPSS 0,34%

Kerentanan Improper Handling of Insufficient Permissions or Privileges pada redhat build of keycloak. Skor CVSS 3.1 4.3 (Medium) menurut redhat.com.

Deskripsi (NVD)

A flaw was found in Keycloak. The User-Managed Access (UMA) 2.0 Protection API endpoint for permission tickets fails to enforce the `uma_protection` role check. This allows any authenticated user with a token issued for a resource server client, even without the `uma_protection` role, to enumerate all permission tickets in the system. This vulnerability partial leads to information disclosure.

Rincian

Terbit di NVD

26 Maret 2026

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

4.3 (Medium), sumber redhat.com
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-280: Improper Handling of Insufficient Permissions or Privileges

EPSS (30 hari)

0,34% peluang dieksploitasi; lebih tinggi dari 25,2% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://access.redhat.com/security/cve/CVE-2026-3190 advisory vendor
• https://bugzilla.redhat.com/show_bug.cgi?id=2442572 issue tracking · advisory vendor
• https://access.redhat.com/errata/RHSA-2026:6477
• https://access.redhat.com/errata/RHSA-2026:6478