~ / search / GHSA-q35r-vvhv-vx5h

GHSA-q35r-vvhv-vx5h

Keycloak: Missing Role Enforcement on UMA 2.0 Permission Ticket Endpoint Leads to Information Disclosure

Source: GitHub Advisory Database (reviewed) Moderate CVE-2026-3190

Packages

EcosystemPackageAffectedFixed in
Maven org.keycloak:keycloak-server-spi-private < 26.5.6 26.5.6
Maven org.keycloak:keycloak-services < 26.5.6 26.5.6
Maven org.keycloak:keycloak-model-jpa < 26.5.6 26.5.6

Details

As written in the advisory (Markdown source, shown as plain text).

A flaw was found in Keycloak. The User-Managed Access (UMA) 2.0 Protection API endpoint for permission tickets fails to enforce the `uma_protection` role check. This allows any authenticated user with a token issued for a resource server client, even without the `uma_protection` role, to enumerate all permission tickets in the system. This vulnerability partial leads to information disclosure.

References

External links from the advisory. They lead to third-party sites.