CVE-2026-3190: Keycloak: Missing Role Enforcement on UMA 2.0 Permission Ticket Endpoint Leads to Information Disclosure
(updated )
A flaw was found in Keycloak. The User-Managed Access (UMA) 2.0 Protection API endpoint for permission tickets fails to enforce the uma_protection role check. This allows any authenticated user with a token issued for a resource server client, even without the uma_protection role, to enumerate all permission tickets in the system. This vulnerability partial leads to information disclosure.
References
- access.redhat.com/errata/RHSA-2026:6477
- access.redhat.com/errata/RHSA-2026:6478
- access.redhat.com/security/cve/CVE-2026-3190
- bugzilla.redhat.com/show_bug.cgi?id=2442572
- github.com/advisories/GHSA-q35r-vvhv-vx5h
- github.com/keycloak/keycloak
- github.com/keycloak/keycloak/commit/f1baf25cbb1551202570f954102eb2d270ab0694
- github.com/keycloak/keycloak/issues/46723
- nvd.nist.gov/vuln/detail/CVE-2026-3190
Code Behaviors & Features
Detect and mitigate CVE-2026-3190 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →