Read the docs
TI-2025-13491 Aliases CVE-2025-14778GHSA-fm6w-rrp3-2x4w

Keycloak: incorrect ownership checks in /uma-policy/

Priority LOW 24CWE-266Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Privilege escalation
Confidentiality · integrity · availability
Low · Low · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-266.

Summary

A flaw was found in Keycloak. A significant Broken Access Control vulnerability exists in the UserManagedPermissionService (UMA Protection API). When updating or deleting a UMA policy associated with multiple resources, the authorization check only verifies the caller's ownership against the first resource in the policy's list. This allows a user (Owner A) who owns one resource (RA) to update a shared policy and modify authorization rules for other resources (e.g., RB) in that same policy, even if those other resources are owned by a different user (Owner B). This constitutes a horizontal privilege escalation.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00318 24th percentileScored 2026-11-07
Fix Fixed org.keycloak:keycloak-services (Maven): 26.2.13, 26.5.3, 26.4.9Red Hat: 4 advisories

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Red HatRed Hat build of Keycloak 26.2—26.2.13-1Patch availableCNA
Red HatRed Hat build of Keycloak 26.2—26.2-15Patch availableCNA
Red HatRed Hat build of Keycloak 26.2—26.2-15Patch availableCNA
Red HatRed Hat build of Keycloak 26.2.13——Not affectedCNA
Red HatRed Hat build of Keycloak 26.4—26.4.9-1Patch availableCNA
Red HatRed Hat build of Keycloak 26.4—26.4-11Patch availableCNA
Red HatRed Hat build of Keycloak 26.4—26.4-10Patch availableCNA
Red HatRed Hat build of Keycloak 26.4.9——Not affectedCNA
—org.keycloak:keycloak-services (Maven)before 26.2.1326.2.13Patch availableGHSA-fm6w-rrp3-2x4w
—org.keycloak:keycloak-services (Maven)26.5.0 to before 26.5.326.5.3Patch availableGHSA-fm6w-rrp3-2x4w
—org.keycloak:keycloak-services (Maven)26.3.0 to before 26.4.926.4.9Patch availableGHSA-fm6w-rrp3-2x4w
  • Red Hat build of Keycloak 26.2 VendorRed Hat Affected — Fixed in 26.2.13-1 Patch available CNA
  • Red Hat build of Keycloak 26.2 VendorRed Hat Affected — Fixed in 26.2-15 Patch available CNA
  • Red Hat build of Keycloak 26.2 VendorRed Hat Affected — Fixed in 26.2-15 Patch available CNA
  • Red Hat build of Keycloak 26.2.13 VendorRed Hat Affected — Fixed in — Not affected CNA
  • Red Hat build of Keycloak 26.4 VendorRed Hat Affected — Fixed in 26.4.9-1 Patch available CNA
  • Red Hat build of Keycloak 26.4 VendorRed Hat Affected — Fixed in 26.4-11 Patch available CNA
  • Red Hat build of Keycloak 26.4 VendorRed Hat Affected — Fixed in 26.4-10 Patch available CNA
  • Red Hat build of Keycloak 26.4.9 VendorRed Hat Affected — Fixed in — Not affected CNA
  • org.keycloak:keycloak-services (Maven) Vendor— Affected before 26.2.13 Fixed in 26.2.13 Patch available GHSA-fm6w-rrp3-2x4w
  • org.keycloak:keycloak-services (Maven) Vendor— Affected 26.5.0 to before 26.5.3 Fixed in 26.5.3 Patch available GHSA-fm6w-rrp3-2x4w
  • org.keycloak:keycloak-services (Maven) Vendor— Affected 26.3.0 to before 26.4.9 Fixed in 26.4.9 Patch available GHSA-fm6w-rrp3-2x4w

CPE names CNA · 2

CPEVersionsRoleVendor
cpe:/a:redhat:build_keycloak:26.2::el926.2—Red Hat
cpe:/a:redhat:build_keycloak:26.4::el926.4—Red Hat
  • cpe:/a:redhat:build_keycloak:26.2::el9 Versions 26.2 — ·Red Hat
  • cpe:/a:redhat:build_keycloak:26.4::el9 Versions 26.4 — ·Red Hat

Remediation

  • Fix · GHSA-fm6w-rrp3-2x4w org.keycloak:keycloak-services (Maven) Fixed in 26.2.13 Advisory →
  • Fix · GHSA-fm6w-rrp3-2x4w org.keycloak:keycloak-services (Maven) Fixed in 26.5.3 Advisory →
  • Fix · GHSA-fm6w-rrp3-2x4w org.keycloak:keycloak-services (Maven) Fixed in 26.4.9 Advisory →

Red Hat 4 advisories

  • RHSA-2026:2364 Released 2026-02-09 · Red Hat rating Important
    Red Hat build of Keycloak 26.2.13 Images Security Update
    • Red Hat build of Keycloak 26.2 rhbk/keycloak-operator-bundle, rhbk/keycloak-rhel9, rhbk/keycloak-rhel9-operator
  • RHSA-2026:2366 Released 2026-02-09 · Red Hat rating Important
    Red Hat build of Keycloak 26.4.9 Images Security Update
    • Red Hat build of Keycloak 26.4 rhbk/keycloak-operator-bundle, rhbk/keycloak-rhel9, rhbk/keycloak-rhel9-operator
  • RHSA-2026:2365 Released 2026-02-09 · Red Hat rating Important
    Red Hat build of Keycloak 26.4.9 Security Update
    • Red Hat build of Keycloak 26.4.9
Show 1 more Red Hat advisories
  • RHSA-2026:2363 Released 2026-02-09 · Red Hat rating Important
    Red Hat build of Keycloak 26.2.13 Security Update
    • Red Hat build of Keycloak 26.2.13

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Advisory ·

    Red Hat build of Keycloak 26.2, Red Hat build of Keycloak 26.2.13 and 2 more products — RHSA-2026:2363

    2 records Highest priority Priority LOW 2 LOW

    Other records, highest priority first

    • TI-2026-01219 Improper signature verification in Red Hat build of Keycloak 26.2Priority LOW 36
    Show all 2 records → Advisory →
  • Advisory ·

    Red Hat build of Keycloak 26.2, Red Hat build of Keycloak 26.2.13 and 2 more products — RHSA-2026:2364

    2 records Highest priority Priority LOW 2 LOW

    Other records, highest priority first

    • TI-2026-01219 Improper signature verification in Red Hat build of Keycloak 26.2Priority LOW 36
    Show all 2 records → Advisory →

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat build of Keycloak 26.2Fixed RHSA-2026:2364
Red Hat build of Keycloak 26.2.13Fixed RHSA-2026:2363
Red Hat build of Keycloak 26.4Fixed RHSA-2026:2366
Red Hat build of Keycloak 26.4.9Fixed RHSA-2026:2365

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-14778
  2. 2026-10-03 Alias added: GHSA-fm6w-rrp3-2x4w

References

Advisory 5

Other 5

  • TI-2019-15875 Protection mechanism failure in Jenkins Pipeline: Groovy Plugin KEVCVSS 3.1CRITICAL 9.9
  • TI-2019-15874 Protection mechanism failure in Jenkins Script Security Plugin KEVCVSS 3.1CRITICAL 9.9
  • TI-2019-08259 Underflow in PHP-FPM can lead to RCE KEVCVSS 3.1CRITICAL 9.8
  • TI-2019-05363 Code injection in Elastic Kibana KEVCVSS 3.1CRITICAL 10.0
  • TI-2019-03949 Out-of-bounds write in ESXi and Horizon DaaS KEVCVSS 3.1CRITICAL 9.8
  • TI-2018-16080 A code execution vulnerability exists in the Stapler web framework used by Jenkins 2.153… KEVCVSS 3.1CRITICAL 9.8
See all 7413 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences