CVE-2026-94217 is a missing authorization vulnerability in the UMA implementation of Red Hat Build of Keycloak. The flaw arises in the authorization token endpoint when processing permission tickets: if two different users own resources with the same name, permissions from both resources are merged incorrectly. This improper isolation by resource owner allows an attacker to gain unauthorized access scopes on a victim's resource. The vulnerability's root cause is the failure to isolate resources by owner during permission ticket lookup. Red Hat rates the severity as Moderate but the CVSS score is 3.5 (low).

Exploitation allows an attacker to gain unauthorized access scopes on a victim's UMA resource due to improper permission merging. This could lead to unauthorized privilege escalation on resources owned by other users. However, exploitation requires a specific resource name collision and prior user interaction by the victim. There is no impact on confidentiality or availability reported, only a low integrity impact.

Red Hat currently does not provide a mitigation or fix that meets their criteria for ease of use, deployment, applicability, or stability. Users should monitor Red Hat advisories for future updates. No official patch or workaround is available at this time.