CVE-2026-3190
MEDIUM
NVD
CVSS Score
4.3
Severity
MEDIUM
Published
Mar 26, 2026
Vendor
unknown
Description
A flaw was found in Keycloak. The User-Managed Access (UMA) 2.0 Protection API endpoint for permission tickets fails to enforce the `uma_protection` role check. This allows any authenticated user with a token issued for a resource server client, even without the `uma_protection` role, to enumerate all permission tickets in the system. This vulnerability partial leads to information disclosure.