CVE-2026-4628: 
Java vulnerability analysis and mitigation

CVE-2026-4628 is an Improper Access Control vulnerability in Keycloak's User-Managed Access (UMA) resource_set endpoint, allowing authenticated attackers to bypass the allowRemoteResourceManagement=false restriction and perform unauthorized modifications to protected resources. The flaw was reported on March 23, 2026, and affects the Red Hat build of Keycloak. It carries a CVSS v3.1 base score of 4.3 (Medium) (Red Hat Advisory, Red Hat Bugzilla).

The root cause is classified as CWE-284 (Improper Access Control). Specifically, access control checks are incompletely enforced on HTTP PUT operations to the /realms/{realm}/authz/protection/resource_set/{id} endpoint. When allowRemoteResourceManagement is set to false, the intent is to prevent remote modification of UMA resources; however, the enforcement logic fails to block PUT requests, allowing any authenticated user with valid credentials to update existing protected resources without requiring elevated privileges or user interaction (Red Hat Bugzilla, Red Hat Advisory).

Successful exploitation allows authenticated attackers to modify protected resource configurations in Keycloak deployments where allowRemoteResourceManagement=false is expected to enforce restrictions. The primary impact is on data integrity — resource attributes and access policies can be altered without authorization. There is no confidentiality or availability impact per the CVSS scoring, and the scope is limited to the affected Keycloak instance (Red Hat Advisory, Red Hat Bugzilla).

1. Reconnaissance: Identify a Keycloak instance where allowRemoteResourceManagement=false is configured for a UMA-enabled authorization server realm.
2. Obtain valid credentials: Acquire a valid user account with at least low-level access to the target Keycloak realm (e.g., a resource owner or registered client).
3. Obtain an access token: Authenticate to Keycloak and retrieve a valid OAuth2/UMA access token for the target realm.
4. Identify target resource: Enumerate existing UMA resources via the resource_set endpoint (GET /realms/{realm}/authz/protection/resource_set) to identify a resource ID to modify.
5. Send malicious PUT request: Issue an HTTP PUT request to /realms/{realm}/authz/protection/resource_set/{id} with a modified resource payload (e.g., altered resource name, URIs, or scopes), using the obtained access token in the Authorization header.
6. Confirm unauthorized modification: Verify that the resource has been updated despite allowRemoteResourceManagement=false being set, confirming the access control bypass (Red Hat Bugzilla).

• Network: Unexpected HTTP PUT requests to /realms/{realm}/authz/protection/resource_set/{id} from authenticated users or clients that should not have resource management permissions.
• Logs: Keycloak server logs showing successful PUT operations on resource_set endpoints when allowRemoteResourceManagement=false is configured; audit log entries reflecting resource attribute changes by non-administrative accounts.
• Application: Unexpected changes to UMA resource configurations (names, URIs, scopes, or owner attributes) in the Keycloak authorization server that were not initiated by administrators.

Red Hat has released patches addressing this vulnerability; Keycloak 26.6.2 includes the fix (Keycloak Release, GitHub Release). Organizations should upgrade to Keycloak 26.6.2 or the patched Red Hat build of Keycloak as the primary remediation. As interim mitigations, administrators should audit resource_set endpoint access logs for suspicious PUT operations, implement network-level controls to restrict access to the UMA protection API to authorized clients only, and review current resource configurations for unauthorized changes (Red Hat Advisory).

The vulnerability received routine coverage from vulnerability tracking services and security aggregators shortly after disclosure on March 23, 2026. No significant researcher commentary, vendor blog posts, or notable social media discussion beyond automated CVE tracking posts (e.g., on Bluesky) has been identified. The moderate CVSS score and requirement for valid credentials have limited broader community attention (Red Hat Bugzilla).