The vulnerability in Red Hat build of Keycloak 26.2 (CVE-2026-4636) arises from incorrect ordering of authorization checks before parsing and canonicalization in UMA policy validation. An authenticated user with the uma_protection role can bypass these validations to create policies referencing resources owned by other users, despite the URL path indicating attacker-owned resources. This leads to unauthorized access by obtaining a Requesting Party Token (RPT) for victim-owned resources. Red Hat has acknowledged this issue and released Keycloak 26.2.15 packages and container images that fix this vulnerability along with other security issues.

Exploitation of this vulnerability allows an authenticated user with the uma_protection role to bypass UMA policy validation and gain unauthorized access to resources owned by other users. This results in confidentiality breaches and unauthorized actions on victim-owned resources. The CVSS v3.1 base score is 8.1 (High), reflecting network attack vector, low attack complexity, required privileges, no user interaction, and high impact on confidentiality and integrity. There are no known exploits in the wild at the time of publication.

Red Hat has released fixed packages for Red Hat build of Keycloak version 26.2.15 that address CVE-2026-4636 along with other vulnerabilities. Users should back up their existing installations, including all applications, configuration files, and databases, before applying the update. The update is available through the Red Hat Customer Portal. Applying this official update is the recommended remediation. No alternative mitigations or workarounds are specified in the advisory.