CVE-2026-118947
Last modified
CVE-2026-118947 is a medium-severity vulnerability rated 4.3/10 on the CVSS scale. A flaw was found in the UMA resource registration endpoint of the keycloak-services component, which provides the core logic for Keycloak's authorization and identity services. The issue occurs when remote resource management is enabled, allowing an authenticated user with specific permissions to update resources they do not own by providing a target resource ID in a request.
Description
A flaw was found in the UMA resource registration endpoint of the keycloak-services component, which provides the core logic for Keycloak's authorization and identity services. The issue occurs when remote resource management is enabled, allowing an authenticated user with specific permissions to update resources they do not own by providing a target resource ID in a request. This can lead to unauthorized modification of resource configurations, such as names, URIs, and scopes.
Metrics
Weakness Enumeration
Affected Software
Source: CNA advisory (CVE.org). NVD analysis pending.
| Vendor | Product | Versions |
|---|---|---|
| Red Hat | Red Hat Build of Keycloak | All versions |
References
Timeline
- Published
- Last Modified
- Status
- Awaiting Analysis
Frequently Asked Questions
What is CVE-2026-118947?
How severe is CVE-2026-118947?
How do I fix CVE-2026-118947?
How Strix Helps
- Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-11890Improper access control in PAM account discovery results in …4.3
- CVE-2026-118905Node Version Manager (nvm) is a POSIX-compliant shell functi…7
- CVE-2026-11891Use After Free vulnerability in Arm Ltd Valhall GPU Userspac…5.1
- CVE-2026-11893The Bluetooth HCI driver for Bouffalo Lab on-chip BLE contro…5.9
- CVE-2026-118938In Trail of Bits fickling through 0.1.12, a pickle STACK_GLO…8.8
- CVE-2026-11894The Realtek BEE Bluetooth HCI driver's send callback, bt_hci…5.9
- CVE-2026-11895The HT Mega Addons for Elementor – Elementor Widgets & Templ…6.4
- CVE-2026-118952A flaw was found in the Kroxylicious ACL authorizer. Its pre…6.5
- CVE-2026-118959A flaw was found in the required action provider mechanism o…5.4
- CVE-2026-11896The My Calendar – Accessible Event Manager plugin for WordPr…5.3
- CVE-2026-11897IBM WebSphere Application Server - Liberty 17.0.0.3 through …7.5
- CVE-2026-11898The White Label CMS plugin for WordPress is vulnerable to St…4.4
Are you affected by CVE-2026-118947?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST