CVE-2026-3190

[CVE catalog]

Severity

Medium · CVSS 4.3CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Published

Feb 24, 2026, 11:00:00 PM UTC

Source

[NVD] · [CVE record]

EPSS

0.33% · Oct 27, 2026

A flaw was found in Keycloak. The User-Managed Access (UMA) 2.0 Protection API endpoint for permission tickets fails to enforce the `uma_protection` role check. This allows any authenticated user with a token issued for a resource server client, even without the `uma_protection` role, to enumerate all permission tickets in the system. This vulnerability partial leads to information disclosure. keycloak: Keycloak: Information Disclosure via improper role enforcement in UMA 2.0 Protection API The issue was rated as Moderate. This flaw in Keycloak allows information disclosure due to improper role enforcement in the UMA 2.0 Protection API. An authenticated user with a token issued for a resource server client, even without the `uma_protection` role, can enumerate all permission tickets in the system. The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.