CVE-2025-14778: 
Java vulnerability analysis and mitigation

CVE-2025-14778 is a Broken Access Control vulnerability in Keycloak's UserManagedPermissionService (UMA Protection API) that enables horizontal privilege escalation. When updating or deleting a UMA policy associated with multiple resources, the authorization check only verifies the caller's ownership against the first resource in the policy's list, allowing a user who owns one resource to modify authorization rules for resources owned by other users. The flaw affects org.keycloak:keycloak-services versions prior to 26.2.13, 26.4.9 (in the 26.3.x–26.4.x range), and 26.5.3 (in the 26.5.x range). It was reported on December 16, 2025, and publicly disclosed on February 9, 2026, with a CVSS v3.1 base score of 5.4 (Medium) (Red Hat CVE, GitHub Advisory).

The root cause is classified as CWE-266 (Incorrect Privilege Assignment). The UserManagedPermissionService endpoint (/uma-policy/) iterates over a list of resources associated with a UMA policy but performs the ownership/authorization check only against the first resource in that list. An authenticated low-privileged user (Owner A) who legitimately owns one resource (RA) in a shared multi-resource policy can craft an update or delete request that also modifies authorization rules for other resources (e.g., RB) owned by a different user (Owner B), because the server never validates ownership of the subsequent resources. The attack vector is network-accessible, requires low privileges, no user interaction, and low attack complexity (Red Hat Bugzilla, GitHub Advisory).

Successful exploitation allows a malicious authenticated user to alter or delete UMA authorization policies for resources they do not own, resulting in unauthorized modification of access controls (integrity impact) and potential unauthorized access to protected resources (confidentiality impact). There is no availability impact. The scope is limited to the affected Keycloak realm's UMA-protected resources, but in multi-tenant or shared environments this could expose sensitive data or grant unintended access to other users' resources (Red Hat CVE, GitHub Advisory).

1. Reconnaissance: Identify a Keycloak instance running a vulnerable version (keycloak-services < 26.2.13, < 26.4.9, or < 26.5.3) with UMA (User-Managed Access) protection enabled on a realm.
2. Obtain credentials: Authenticate as a low-privileged user (Owner A) who owns at least one UMA-protected resource (RA) in the target realm.
3. Identify a shared policy: Enumerate UMA policies via the /realms/{realm}/authz/protection/uma-policy/ endpoint to find a policy that references multiple resources, including at least one resource (RA) owned by Owner A and one (RB) owned by another user (Owner B).
4. Craft a malicious update request: Send a PUT or DELETE request to /realms/{realm}/authz/protection/uma-policy/{policyId} with Owner A's access token, modifying the policy's permissions or scopes for resource RB. Because the server only checks ownership of the first resource (RA), the request passes authorization.
5. Achieve privilege escalation: The policy for RB is now modified under Owner A's control, potentially granting Owner A (or others) unauthorized access to RB or revoking Owner B's intended access controls (Red Hat Bugzilla, GitHub Advisory).

• Network: Unexpected PUT or DELETE requests to /realms/{realm}/authz/protection/uma-policy/{policyId} from users who do not own all resources referenced in the targeted policy.
• Logs: Keycloak audit/event logs showing UMA policy update or delete events (UPDATE_POLICY, DELETE_POLICY) where the acting user's resource ownership does not match all resources in the modified policy.
• Application Behavior: UMA policy changes affecting resources owned by users other than the requester; unexpected changes to resource sharing permissions reported by resource owners (Owner B) who did not initiate the change.

Upgrade org.keycloak:keycloak-services (and the corresponding Keycloak server) to one of the patched versions: 26.2.13, 26.4.9, or 26.5.3. Red Hat build of Keycloak users should apply the corresponding errata: RHSA-2026:2363 / RHSA-2026:2364 (for 26.2.13), RHSA-2026:2365 (for 26.4.9), or RHSA-2026:2366 (for 26.5.3). No configuration-based workaround is documented; upgrading to a patched release is the recommended remediation (Red Hat RHSA-2026:2363, Red Hat RHSA-2026:2365, GitHub Advisory).

Red Hat rated the advisory as Important severity across multiple errata releases on February 9, 2026, reflecting the significance of the access control flaw in a widely deployed identity and access management platform. The vulnerability was credited to researcher eminaktas in the GitHub Advisory Database. No notable broader media coverage or significant social media discussion has been identified beyond standard vulnerability tracking sources (GitHub Advisory, Red Hat RHSA-2026:2363).