The vulnerability in Red Hat build of Keycloak 26.2 prior to 26.2.15 involves incorrect ordering of authorization checks before parsing and canonicalization in UMA policy validation. Authenticated users with the uma_protection role can bypass policy validation by including resource identifiers owned by other users in policy creation requests. This bypass allows attackers to gain unauthorized permissions to victim-owned resources and obtain Requesting Party Tokens (RPT), leading to unauthorized access to sensitive information or actions. The issue is tracked as CVE-2026-4636 with a CVSS 3.1 score of 8.1 (High). Red Hat has published security advisories and released version 26.2.15 to fix this vulnerability.

An attacker with authenticated access and the uma_protection role can bypass UMA policy validation to gain unauthorized access to resources owned by other users. This can lead to unauthorized disclosure of sensitive information or unauthorized actions performed on victim-owned resources. The vulnerability affects confidentiality and integrity but does not impact availability.

Red Hat has released an official fix in Red Hat build of Keycloak version 26.2.15. Users should upgrade to version 26.2.15 or later to remediate this vulnerability. Before applying the update, back up existing installations, including applications, configuration files, and databases. No other mitigations are specified by the vendor.