| Package | Affected versions | Patched versions |
|---|---|---|
| org.keycloak:keycloak-model-jpa | < 26.5.6 | 26.5.6 |
| org.keycloak:keycloak-server-spi-private | < 26.5.6 | 26.5.6 |
| org.keycloak:keycloak-services | < 26.5.6 | 26.5.6 |
A flaw was found in Keycloak. The User-Managed Access (UMA) 2.0 Protection API endpoint for permission tickets fails to enforce the uma_protection role check. This allows any authenticated user with a token issued for a resource server client, even without the uma_protection role, to enumerate all permission tickets in the system. This vulnerability partial leads to information disclosure.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free