A vulnerability in the UserManagedPermissionService of the Keycloak authorization server allows authenticated users to create policies that apply to resources owned by other users. This occurs because the UMA Protection API does not validate the resourceType field during policy creation, potentially enabling unauthorized access or modification of sensitive data within the same realm.