Vulnerability · Published Feb 9, 2026 · Assigned by redhat
CVE-2025-14778Keycloak: incorrect ownership checks in /uma-policy/
Medium 5.4
In plain English
A medium-severity security flaw in Red Hat build of Keycloak 26.2 from Red Hat. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 25% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
A flaw was found in Keycloak. A significant Broken Access Control vulnerability exists in the UserManagedPermissionService (UMA Protection API). When updating or deleting a UMA policy associated with multiple resources, the authorization check only verifies the caller's ownership against the first resource in the policy's list. This allows a user (Owner A) who owns one resource (RA) to update a shared policy and modify authorization rules for other resources (e.g., RB) in that same policy, even if those other resources are owned by a different user (Owner B). This constitutes a horizontal privilege escalation.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Maven | org.keycloak:keycloak-services | 26.2.13 | GHSA-fm6w-rrp3-2x4w |
| Maven | org.keycloak:keycloak-services | 26.5.3 | GHSA-fm6w-rrp3-2x4w |
| Maven | org.keycloak:keycloak-services | 26.4.9 | GHSA-fm6w-rrp3-2x4w |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Red Hat | Red Hat build of Keycloak 26.2 | see references |
| Red Hat | Red Hat build of Keycloak 26.2 | see references |
| Red Hat | Red Hat build of Keycloak 26.2 | see references |
| Red Hat | Red Hat build of Keycloak 26.2.13 | see references |
| Red Hat | Red Hat build of Keycloak 26.4 | see references |
| Red Hat | Red Hat build of Keycloak 26.4 | see references |
| Red Hat | Red Hat build of Keycloak 26.4 | see references |
| Red Hat | Red Hat build of Keycloak 26.4.9 | see references |
Weakness: CWE-266 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
References
- RHSA-2026:2363 vendor-advisory, x_refsource_REDHAT
- RHSA-2026:2364 vendor-advisory, x_refsource_REDHAT
- RHSA-2026:2365 vendor-advisory, x_refsource_REDHAT
- RHSA-2026:2366 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/security/cve/CVE-2025-14778 vdb-entry, x_refsource_REDHAT
- RHBZ#2422600 issue-tracking, x_refsource_REDHAT