Signal is active with 2 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
A flaw was found in Keycloak. A significant Broken Access Control vulnerability exists in the UserManagedPermissionService (UMA Protection API). When updating or deleting a UMA policy associated with multiple resources, the authorization check only verifies the caller's ownership against the first resource in the policy's list. This allows a user (Owner A) who owns one resource (RA) to update a shared policy and modify authorization rules for other resources (e.g., RB) in that same policy, even if those other resources are owned by a different user (Owner B). This constitutes a horizontal privilege escalation.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
STABLE
| Date | Total | Labels |
|---|
| 2026-02-09 | 1 | Disclosure1 |
| 2026-02-10 | 2 | Disclosure2 |
CVE-2025-14778 Keycloak UMA Protection API Horizontal Privilege Escalation Vulnerability https://vulmon.com/vulnerabilitydetails?qid=CVE-2025-14778
Post summary
The entry identifies CVE-2025-14778 as a horizontal privilege escalation flaw in Keycloak’s UMA Protection API, but offers no PoC, exploitation, or patch details.
CVE-2025-14778 A flaw was found in Keycloak. A significant Broken Access Control vulnerability exists in the UserManagedPermissionService (UMA Protection API). When updating or dele… https://www.cve.org/CVERecord?id=CVE-2025-14778
Post summary
The text announces a broken access control vulnerability (CVE‑2025‑14778) in Keycloak's UserManagedPermissionService, with no PoC, exploit, or patch information provided.
CVE-2025-14778: Keycloak UMA: The 'First-Item-Wins' Access Control Disaster A logic flaw in Keycloak's User-Managed Access (UMA) Protection API allows for horizontal privilege escalation. By exploiting how the system validates resource ownership in sh... https://cvereports.com/reports/CVE-2025-14778
Post summary
The report highlights a logic flaw in Keycloak’s UMA API that enables horizontal privilege escalation through incorrect resource ownership validation.