CVE-2025-14778 Keycloak: incorrect ownership checks in /uma-policy/

What is CVE-2025-14778?

CVE-2025-14778 is a medium-severity missing authorization vulnerability in Red Hat build of Keycloak 26.2, published on 9 Feb 2026. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

A flaw was found in Keycloak. A significant Broken Access Control vulnerability exists in the UserManagedPermissionService (UMA Protection API). When updating or deleting a UMA policy associated with multiple resources, the authorization check only verifies the caller's ownership against the first resource in the policy's list. This allows a user (Owner A) who owns one resource (RA) to update a shared policy and modify authorization rules for other resources (e.g., RB) in that same policy, even if those other resources are owned by a different user (Owner B). This constitutes a horizontal privilege escalation.

Weakness: CWE-266

Which versions are affected by CVE-2025-14778?

6 open source packages ship an affected version, including org.keycloak:keycloak-services.

How do I fix CVE-2025-14778?

Upgrade org.keycloak:keycloak-services to a fixed version for your release line: 26.2.13, 26.4.9 or 26.5.3.

Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.

Is CVE-2025-14778 being exploited?

There is no known exploitation of CVE-2025-14778 in the wild and no public exploit code.

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as ECHO-a380-e585-5861, GHSA-fm6w-rrp3-2x4w, MINI-29v2-j8ww-hp96, MINI-2g82-mfv8-7jcc.