5.4

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2025-14778

CVE-2025-14778: Keycloak Affected by Broken Access Control Vulnerability in the UserManagedPermissionService

A flaw was found in Keycloak. A significant Broken Access Control vulnerability exists in the UserManagedPermissionService (UMA Protection API). When updating or deleting a UMA policy associated with multiple resources, the authorization check only verifies the caller's ownership against the first resource in the policy's list. This allows a user (Owner A) who owns one resource (RA) to update a shared policy and modify authorization rules for other resources (e.g., RB) in that same policy, even if those other resources are owned by a different user (Owner B). This constitutes a horizontal privilege escalation.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2025-14778

CVE-2025-14778:

5.4

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
org.keycloak:keycloak-services	maven	< 26.5.3	26.5.3

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The analysis of the provided patch for Keycloak reveals a broken access control vulnerability within the UserManagedPermissionService. The vulnerability, as described, allows for horizontal privilege escalation when updating UMA policies that apply to multiple resources.

The root cause of the vulnerability is that the authorization check only validates the caller's ownership against the first resource listed in the policy. The getAssociatedResourceId(policyId) method retrieves only this first resource, and the subsequent checkRequest call uses it to authorize the entire operation. If a policy contains resources owned by different users, a user owning only the first resource can modify the policy for all associated resources.

The provided commit 96797bb125ea044b18f3e76bbfa364657f1186ef specifically addresses this issue within the update method of the UserManagedPermissionService.java file. The patch introduces a check that prevents the set of resources in a policy from being changed during an update. If the update attempts to add, remove, or change the resources, the request is rejected. This effectively prevents the exploitation of the vulnerability through the update operation.

Based on the evidence in the patch, the org.keycloak.authorization.protection.policy.UserManagedPermissionService.update function is identified as the vulnerable function. During exploitation, this function would be present in the runtime profile as it processes the malicious update request. While the vulnerability description also mentions the delete operation, the provided patch only contains changes for the update method, so the analysis is focused on the evidence present in the commit.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.