Threats tagged 'ghsa-w3p3-7cjg-vgfw'

A vulnerability in org.keycloak:keycloak-services allows an authenticated user with a User-Managed Access (UMA) permission ticket for one resource to bypass per-resource access controls and gain unauthorized access to all resources of that type within the same resource server. This issue occurs when the resource server is configured in PERMISSIVE policy enforcement mode and affects typed resources with ownerManagedAccess enabled without explicit policies protecting the resource type. The vulnerability can lead to unauthorized information disclosure or modification of resources. A fix is available in version 26.6.4.