CVE-2026-4628

Katalog CVE

CVSS 4.3 · Medium EPSS 0,27%

Kerentanan Improper Access Control pada redhat build of keycloak. Skor CVSS 3.1 4.3 (Medium) menurut redhat.com.

Deskripsi (NVD)

A flaw was found in Keycloak. An improper Access Control vulnerability in Keycloak’s User-Managed Access (UMA) resource_set endpoint allows attackers with valid credentials to bypass the allowRemoteResourceManagement=false restriction. This occurs due to incomplete enforcement of access control checks on PUT operations to the resource_set endpoint. This issue enables unauthorized modification of protected resources, impacting data integrity.

Rincian

Terbit di NVD

23 Maret 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

4.3 (Medium), sumber redhat.com
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-284: Improper Access Control

EPSS (30 hari)

0,27% peluang dieksploitasi; lebih tinggi dari 17,0% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://access.redhat.com/security/cve/CVE-2026-4628 advisory vendor
• https://bugzilla.redhat.com/show_bug.cgi?id=2450240 issue tracking · advisory vendor