CVE-2026-118947 | CVSS: 4.3 | 严重级别: MEDIUM
A flaw was found in the UMA resource registration endpoint of the keycloak-services component, which provides the core logic for Keycloak's authorization and identity services. The issue occurs when remote resource management is enabled, allowing an authenticated user with specific permissions to update resources they do not own by providing a target resource ID in a request. This can lead to unauthorized modification of resource configurations, such as names, URIs, and scopes.
参考链接:
• https://access.redhat.com/security/cve/CVE-2026-118947
• https://bugzilla.redhat.com/show_bug.cgi?id=2563274
📌 数据来源: NVD 官方
⚠️ 合规声明: 本文内容仅用于网络安全合规学习、科研与授权测试用途。严禁用于任何未授权行为,违者自行承担全部法律责任。