{
  "threat_severity" : "Moderate",
  "public_date" : "2026-02-25T07:07:00Z",
  "bugzilla" : {
    "description" : "keycloak: Keycloak: Information Disclosure via improper role enforcement in UMA 2.0 Protection API",
    "id" : "2442572",
    "url" : "https://bugzilla.redhat.com/show_bug.cgi?id=2442572"
  },
  "cvss3" : {
    "cvss3_base_score" : "4.3",
    "cvss3_scoring_vector" : "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
    "status" : "verified"
  },
  "cwe" : "CWE-280",
  "details" : [ "A flaw was found in Keycloak. The User-Managed Access (UMA) 2.0 Protection API endpoint for permission tickets fails to enforce the `uma_protection` role check. This allows any authenticated user with a token issued for a resource server client, even without the `uma_protection` role, to enumerate all permission tickets in the system. This vulnerability partial leads to information disclosure.", "A flaw was found in Keycloak. The User-Managed Access (UMA) 2.0 Protection API endpoint for permission tickets fails to enforce the `uma_protection` role check. This allows any authenticated user with a token issued for a resource server client, even without the `uma_protection` role, to enumerate all permission tickets in the system. This vulnerability partial leads to information disclosure." ],
  "statement" : "The issue was rated as Moderate. This flaw in Keycloak allows information disclosure due to improper role enforcement in the UMA 2.0 Protection API. An authenticated user with a token issued for a resource server client, even without the `uma_protection` role, can enumerate all permission tickets in the system.",
  "acknowledgement" : "Red Hat would like to thank Evan Hendra (Independent Security Researcher) for reporting this issue.",
  "affected_release" : [ {
    "product_name" : "Red Hat build of Keycloak 26.4",
    "release_date" : "2026-04-02T00:00:00Z",
    "advisory" : "RHSA-2026:6478",
    "cpe" : "cpe:/a:redhat:build_keycloak:26.4::el9",
    "package" : "rhbk/keycloak-operator-bundle:26.4.11-1"
  }, {
    "product_name" : "Red Hat build of Keycloak 26.4",
    "release_date" : "2026-04-02T00:00:00Z",
    "advisory" : "RHSA-2026:6478",
    "cpe" : "cpe:/a:redhat:build_keycloak:26.4::el9",
    "package" : "rhbk/keycloak-rhel9:26.4-14"
  }, {
    "product_name" : "Red Hat build of Keycloak 26.4",
    "release_date" : "2026-04-02T00:00:00Z",
    "advisory" : "RHSA-2026:6478",
    "cpe" : "cpe:/a:redhat:build_keycloak:26.4::el9",
    "package" : "rhbk/keycloak-rhel9-operator:26.4-14"
  }, {
    "product_name" : "Red Hat build of Keycloak 26.4.11",
    "release_date" : "2026-04-02T00:00:00Z",
    "advisory" : "RHSA-2026:6477",
    "cpe" : "cpe:/a:redhat:build_keycloak:26.4::el9",
    "package" : "rhbk/keycloak-rhel9"
  } ],
  "references" : [ "https://www.cve.org/CVERecord?id=CVE-2026-3190\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-3190" ],
  "name" : "CVE-2026-3190",
  "mitigation" : {
    "value" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
    "lang" : "en:us"
  },
  "csaw" : false
}