CVE-2026-3190 PUBLISHED

Keycloak: keycloak: information disclosure via improper role enforcement in uma 2.0 protection api

Assigner: redhat
Reserved: 25.02.2026 Published: 26.03.2026 Updated: 27.03.2026

A flaw was found in Keycloak. The User-Managed Access (UMA) 2.0 Protection API endpoint for permission tickets fails to enforce the uma_protection role check. This allows any authenticated user with a token issued for a resource server client, even without the uma_protection role, to enumerate all permission tickets in the system. This vulnerability partial leads to information disclosure.

Metrics

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
CVSS Score: 4.3

Product Status

Vendor Red Hat
Product Red Hat Build of Keycloak
Versions Default: affected

Workarounds

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.

Credits

  • Red Hat would like to thank Evan Hendra (Independent Security Researcher) for reporting this issue.

References

Problem Types

  • Improper Handling of Insufficient Permissions or Privileges CWE