CVE-2026-4628

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-4628", "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "state": "PUBLISHED", "assignerShortName": "redhat", "dateReserved": "2026-03-23T07:45:26.489Z", "datePublished": "2026-03-23T08:09:22.123Z", "dateUpdated": "2026-10-22T20:38:05.995Z"}, "containers": {"cna": {"title": "Keycloak: org.keycloak.authorization: keycloak: unauthorized resource modification due to improper access control", "metrics": [{"other": {"content": {"value": "Moderate", "namespace": "https://access.redhat.com/security/updates/classification/"}, "type": "Red Hat severity rating"}}, {"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N", "version": "3.1"}, "format": "CVSS"}], "descriptions": [{"lang": "en", "value": "A flaw was found in Keycloak. An improper Access Control vulnerability in Keycloak\u2019s User-Managed Access (UMA) resource_set endpoint allows attackers with valid credentials to bypass the allowRemoteResourceManagement=false restriction. This occurs due to incomplete enforcement of access control checks on PUT operations to the resource_set endpoint. This issue enables unauthorized modification of protected resources, impacting data integrity."}], "affected": [{"vendor": "Red Hat", "product": "Red Hat build of Keycloak 26.4.12", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "unaffected", "cpes": ["cpe:/a:redhat:build_keycloak:26.4::el9"]}, {"vendor": "Red Hat", "product": "Red Hat Build of Keycloak", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "keycloak-services", "defaultStatus": "affected", "cpes": ["cpe:/a:redhat:build_keycloak:"]}, {"vendor": "Red Hat", "product": "Red Hat JBoss Enterprise Application Platform 8", "collectionURL": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html", "packageName": "keycloak-services", "defaultStatus": "unaffected", "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform:8"]}, {"vendor": "Red Hat", "product": "Red Hat JBoss Enterprise Application Platform Expansion Pack", "collectionURL": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html", "packageName": "keycloak-services", "defaultStatus": "unaffected", "cpes": ["cpe:/a:redhat:jbosseapxp"]}, {"vendor": "Red Hat", "product": "Red Hat Single Sign-On 7", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "keycloak-services", "defaultStatus": "unaffected", "cpes": ["cpe:/a:redhat:red_hat_single_sign_on:7"]}], "references": [{"url": "https://access.redhat.com/errata/RHSA-2026:19596", "name": "RHSA-2026:19596", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/security/cve/CVE-2026-4628", "tags": ["vdb-entry", "x_refsource_REDHAT"]}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2450240", "name": "RHBZ#2450240", "tags": ["issue-tracking", "x_refsource_REDHAT"]}], "datePublic": "2026-03-23T00:00:00.000Z", "problemTypes": [{"descriptions": [{"cweId": "CWE-284", "description": "Improper Access Control", "lang": "en", "type": "CWE"}]}], "x_redhatCweChain": "CWE-284: Improper Access Control", "workarounds": [{"lang": "en", "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."}], "timeline": [{"lang": "en", "time": "2026-03-23T07:44:56.514Z", "value": "Reported to Red Hat."}, {"lang": "en", "time": "2026-03-23T00:00:00.000Z", "value": "Made public."}], "credits": [{"lang": "en", "value": "Red Hat would like to thank Evan Hendra for reporting this issue."}], "providerMetadata": {"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "shortName": "redhat", "dateUpdated": "2026-10-22T20:38:05.995Z"}, "x_generator": {"engine": "cvelib 1.8.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-03-25T14:02:51.761138Z", "id": "CVE-2026-4628", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-25T14:03:04.463Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-4628", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-03-25T14:02:51.761138Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-25T14:02:18.546Z"}}], "cna": {"title": "Keycloak: org.keycloak.authorization: keycloak: unauthorized resource modification due to improper access control", "credits": [{"lang": "en", "value": "Red Hat would like to thank Evan Hendra for reporting this issue."}], "metrics": [{"other": {"type": "Red Hat severity rating", "content": {"value": "Moderate", "namespace": "https://access.redhat.com/security/updates/classification/"}}}, {"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}}], "affected": [{"cpes": ["cpe:/a:redhat:build_keycloak:26.4::el9"], "vendor": "Red Hat", "product": "Red Hat build of Keycloak 26.4.12", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "unaffected"}, {"cpes": ["cpe:/a:redhat:build_keycloak:"], "vendor": "Red Hat", "product": "Red Hat Build of Keycloak", "packageName": "keycloak-services", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform:8"], "vendor": "Red Hat", "product": "Red Hat JBoss Enterprise Application Platform 8", "packageName": "keycloak-services", "collectionURL": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html", "defaultStatus": "unaffected"}, {"cpes": ["cpe:/a:redhat:jbosseapxp"], "vendor": "Red Hat", "product": "Red Hat JBoss Enterprise Application Platform Expansion Pack", "packageName": "keycloak-services", "collectionURL": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html", "defaultStatus": "unaffected"}, {"cpes": ["cpe:/a:redhat:red_hat_single_sign_on:7"], "vendor": "Red Hat", "product": "Red Hat Single Sign-On 7", "packageName": "keycloak-services", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2026-03-23T07:44:56.514Z", "value": "Reported to Red Hat."}, {"lang": "en", "time": "2026-03-23T00:00:00.000Z", "value": "Made public."}], "datePublic": "2026-03-23T00:00:00.000Z", "references": [{"url": "https://access.redhat.com/errata/RHSA-2026:19596", "name": "RHSA-2026:19596", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/security/cve/CVE-2026-4628", "tags": ["vdb-entry", "x_refsource_REDHAT"]}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2450240", "name": "RHBZ#2450240", "tags": ["issue-tracking", "x_refsource_REDHAT"]}], "workarounds": [{"lang": "en", "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."}], "x_generator": {"engine": "cvelib 1.8.0"}, "descriptions": [{"lang": "en", "value": "A flaw was found in Keycloak. An improper Access Control vulnerability in Keycloak\u2019s User-Managed Access (UMA) resource_set endpoint allows attackers with valid credentials to bypass the allowRemoteResourceManagement=false restriction. This occurs due to incomplete enforcement of access control checks on PUT operations to the resource_set endpoint. This issue enables unauthorized modification of protected resources, impacting data integrity."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-284", "description": "Improper Access Control"}]}], "providerMetadata": {"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "shortName": "redhat", "dateUpdated": "2026-10-22T20:38:05.995Z"}, "x_redhatCweChain": "CWE-284: Improper Access Control"}}, "cveMetadata": {"cveId": "CVE-2026-4628", "state": "PUBLISHED", "dateUpdated": "2026-10-22T20:38:05.995Z", "dateReserved": "2026-03-23T07:45:26.489Z", "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "datePublished": "2026-03-23T08:09:22.123Z", "assignerShortName": "redhat"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:build_keycloak:26.4::el9"], "defaultStatus": "unaffected", "product": "Red Hat build of Keycloak 26.4.12", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:build_keycloak:"], "defaultStatus": "affected", "packageName": "keycloak-services", "product": "Red Hat Build of Keycloak", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html", "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform:8"], "defaultStatus": "unaffected", "packageName": "keycloak-services", "product": "Red Hat JBoss Enterprise Application Platform 8", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html", "cpes": ["cpe:/a:redhat:jbosseapxp"], "defaultStatus": "unaffected", "packageName": "keycloak-services", "product": "Red Hat JBoss Enterprise Application Platform Expansion Pack", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:red_hat_single_sign_on:7"], "defaultStatus": "unaffected", "packageName": "keycloak-services", "product": "Red Hat Single Sign-On 7", "vendor": "Red Hat"}], "source": "secalert@redhat.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:redhat:build_of_keycloak:-:*:*:*:-:*:*:*", "matchCriteriaId": "E5C930CB-4EAD-497B-A44B-D880F2A1F85B", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A flaw was found in Keycloak. An improper Access Control vulnerability in Keycloak\u2019s User-Managed Access (UMA) resource_set endpoint allows attackers with valid credentials to bypass the allowRemoteResourceManagement=false restriction. This occurs due to incomplete enforcement of access control checks on PUT operations to the resource_set endpoint. This issue enables unauthorized modification of protected resources, impacting data integrity."}, {"lang": "es", "value": "Se encontr\u00f3 un fallo en Keycloak. Una vulnerabilidad de control de acceso inadecuado en el endpoint 'resource_set' de Acceso Gestionado por el Usuario (UMA) de Keycloak permite a atacantes con credenciales v\u00e1lidas eludir la restricci\u00f3n 'allowRemoteResourceManagement=false'. Esto ocurre debido a la aplicaci\u00f3n incompleta de las comprobaciones de control de acceso en operaciones PUT al endpoint 'resource_set'. Este problema permite la modificaci\u00f3n no autorizada de recursos protegidos, impactando la integridad de los datos."}], "id": "CVE-2026-4628", "lastModified": "2026-10-22T21:17:18.640", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 1.4, "source": "secalert@redhat.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-4628", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-03-25T14:02:51.761138Z", "version": "2.0.3"}}]}, "published": "2026-03-23T09:16:26.140", "references": [{"source": "secalert@redhat.com", "url": "https://access.redhat.com/errata/RHSA-2026:19596"}, {"source": "secalert@redhat.com", "tags": ["Vendor Advisory"], "url": "https://access.redhat.com/security/cve/CVE-2026-4628"}, {"source": "secalert@redhat.com", "tags": ["Issue Tracking", "Vendor Advisory"], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2450240"}], "sourceIdentifier": "secalert@redhat.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-284"}], "source": "secalert@redhat.com", "type": "Secondary"}]}

{"acknowledgement": "Red Hat would like to thank Evan Hendra for reporting this issue.", "bugzilla": {"description": "keycloak: org.keycloak.authorization: Keycloak: Unauthorized resource modification due to improper access control", "id": "2450240", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2450240"}, "csaw": false, "cvss3": {"cvss3_base_score": "4.3", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N", "status": "draft"}, "cwe": "CWE-284", "details": ["A flaw was found in Keycloak. An improper Access Control vulnerability in Keycloak\u2019s User-Managed Access (UMA) resource_set endpoint allows attackers with valid credentials to bypass the allowRemoteResourceManagement=false restriction. This occurs due to incomplete enforcement of access control checks on PUT operations to the resource_set endpoint. This issue enables unauthorized modification of protected resources, impacting data integrity."], "mitigation": {"lang": "en:us", "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."}, "name": "CVE-2026-4628", "package_state": [{"cpe": "cpe:/a:redhat:build_keycloak:", "fix_state": "Affected", "package_name": "keycloak-services", "product_name": "Red Hat Build of Keycloak"}, {"cpe": "cpe:/a:redhat:jboss_enterprise_application_platform:8", "fix_state": "Not affected", "package_name": "keycloak-services", "product_name": "Red Hat JBoss Enterprise Application Platform 8"}, {"cpe": "cpe:/a:redhat:jbosseapxp", "fix_state": "Not affected", "package_name": "keycloak-services", "product_name": "Red Hat JBoss Enterprise Application Platform Expansion Pack"}, {"cpe": "cpe:/a:redhat:red_hat_single_sign_on:7", "fix_state": "Not affected", "package_name": "keycloak-services", "product_name": "Red Hat Single Sign-On 7"}], "public_date": "2026-03-23T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-4628\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-4628"], "statement": "MODERATE: This flaw in Keycloak allows authenticated attackers to bypass the `allowRemoteResourceManagement=false` restriction, enabling unauthorized modification of protected resources. This impacts data integrity in Red Hat Build of Keycloak (RHBK) version rhbk-26.4. Other Red Hat products, including Enterprise Application Platform and Red Hat Single Sign-On, are not affected as the vulnerable code is not present.", "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": null}], "enrichment": {"confidence": 95.0, "confidence_source": "inferred", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 98.0, "source": "matching"}]}, "original": {"product": "Red Hat Build of Keycloak", "source": "cna", "vendor": "Red Hat"}, "product": "build_of_keycloak", "vendor": "redhat"}, {"configurations": [{"platform": null, "status": "unaffected", "versions": null}], "enrichment": {"confidence": 95.0, "confidence_source": "inferred", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 97.0, "source": "matching"}]}, "original": {"product": "Red Hat JBoss Enterprise Application Platform 8", "source": "cna", "vendor": "Red Hat"}, "product": "jboss_enterprise_application_platform", "vendor": "redhat"}, {"configurations": [{"platform": null, "status": "unaffected", "versions": null}], "enrichment": {"confidence": 95.0, "confidence_source": "inferred", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 99.0, "source": "matching"}]}, "original": {"product": "Red Hat JBoss Enterprise Application Platform Expansion Pack", "source": "cna", "vendor": "Red Hat"}, "product": "jboss_enterprise_application_platform_expansion_pack", "vendor": "redhat"}, {"configurations": [{"platform": null, "status": "affected", "versions": null}], "enrichment": {"confidence": 80.0, "confidence_source": "inferred", "scores": [{"score": 80.0, "source": "inferred"}, {"score": 97.0, "source": "matching"}]}, "product": "keycloak", "vendor": "redhat"}, {"configurations": [{"platform": null, "status": "unaffected", "versions": null}], "enrichment": {"confidence": 93.0, "confidence_source": "matching", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 93.0, "source": "matching"}]}, "original": {"product": "Red Hat Single Sign-On 7", "source": "cna", "vendor": "Red Hat"}, "product": "single_sign-on", "vendor": "redhat"}], "analysis": {"en": {"generated_at": "2026-04-02T05:25:55.795240+00:00", "value": {"mitigation_remediation": ["Check Red\u202fHat\u2019s security portal for an update or patch and apply it as soon as available", "Verify that the allowRemoteResourceManagement setting remains false and restrict UMA resource_set access to trusted administrative roles", "If a patch cannot be applied, disable the UMA feature or block external access to the resource_set endpoint", "Continuously monitor Keycloak logs for unauthorized PUT operations to the resource_set endpoint", "No workaround available; official Red\u202fHat guidance states mitigation options are inadequate"], "summary": {"action": "Patch", "impact": "Unauthorized modification of protected resources, compromising data integrity"}, "threat_synthesis": {"affected_systems": "The vulnerability affects Red\u202fHat products including Red\u202fHat Build of Keycloak, Red\u202fHat JBoss Enterprise Application Platform 8, Red\u202fHat JBoss Enterprise Application Platform Expansion Pack, and Red\u202fHat Single Sign\u2011On\u202f7. Specific version details are not specified in the CNA data; administrators should review all deployed instances of these products for potential exposure.", "description_and_impact": "A flaw exists in Keycloak\u2019s User\u2011Managed Access (UMA) resource_set endpoint that allows an authenticated attacker to bypass the allowRemoteResourceManagement=false restriction. The vulnerability arises from incomplete enforcement of access control checks on PUT operations, enabling an attacker with valid credentials to modify protected resources. This results in unauthorized changes that compromise data integrity and stems from an improper access control weakness (CWE\u2011284).", "risk_and_exploitability": "The CVSS score of 4.3 indicates moderate severity, while the EPSS score of less than 1% suggests a low likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog. The attack vector is inferred: an attacker who authenticates to Keycloak can issue a PUT request to the resource_set endpoint and alter resources regardless of the configured restriction. No public patch or workaround is currently available, increasing risk for systems that have not applied an official security update."}}}}, "created": "2026-03-24T10:34:52.327045+00:00", "updated": "2026-04-02T07:59:30.429059+00:00", "vendors": ["redhat", "redhat$PRODUCT$build_of_keycloak", "redhat$PRODUCT$jboss_enterprise_application_platform", "redhat$PRODUCT$jboss_enterprise_application_platform_expansion_pack", "redhat$PRODUCT$keycloak", "redhat$PRODUCT$single_sign-on"]}