CVE-2025-14778

A flaw was found in Keycloak. A significant Broken Access Control vulnerability exists in the UserManagedPermissionService (UMA Protection API). When updating or deleting a UMA policy associated with multiple resources, the authorization check only verifies the caller's ownership against the first resource in the policy's list. This allows a user (Owner A) who owns one resource (RA) to update a shared policy and modify authorization rules for other resources (e.g., RB) in that same policy, even if those other resources are owned by a different user (Owner B). This constitutes a horizontal privilege escalation.

• CWE-266

• https://access.redhat.com/errata/RHSA-2026:2363
• https://access.redhat.com/errata/RHSA-2026:2364
• https://access.redhat.com/errata/RHSA-2026:2365
• https://access.redhat.com/errata/RHSA-2026:2366
• https://access.redhat.com/security/cve/CVE-2025-14778
• https://bugzilla.redhat.com/show_bug.cgi?id=2422600

Published

Feb 9, 2026

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-14770The Shipping Rate By Cities plugin for WordPress is vulnerab…7.5
• CVE-2025-14771Files or directories accessible to external parties vulnerab…9.9
• CVE-2025-14772Authorization bypass through User-Controlled key vulnerabili…8.8
• CVE-2025-14773Improper neutralization of input during web page generation …5.4
• CVE-2025-14774Incorrect Authorization vulnerability in ABB T-MAC Plus. Th…7.4
• CVE-2025-14777A flaw was found in Keycloak. An IDOR (Broken Access Control…6
• CVE-2025-14779The Secret Type Management REST API does not correctly isola…3.8
• CVE-2025-1478An issue has been discovered in GitLab CE/EE affecting all v…7.5
• CVE-2025-14780A vulnerability was detected in Xiongwei Smart Catering Clou…6.3
• CVE-2025-14782The Forminator Forms – Contact Form, Payment Form & Custom F…5.3
• CVE-2025-14783The Easy Digital Downloads plugin for WordPress is vulnerabl…4.3
• CVE-2025-14785The Website Builder by SeedProd - Theme Builder, Landing Pag…6.4