CyberRota Analysis
This is a medium severity vulnerability with a CVSS score of 4.3. Exploitation may require the attacker to be authenticated.
CVE
CVE-2026-3190
Severity
MEDIUM
CVSS
4.3
EPSS
0.32%
Original NVD Description
A flaw was found in Keycloak. The User-Managed Access (UMA) 2.0 Protection API endpoint for permission tickets fails to enforce the `uma_protection` role check. This allows any authenticated user with a token issued for a resource server client, even without the `uma_protection` role, to enumerate all permission tickets in the system. This vulnerability partial leads to information disclosure.
Related CVEs
Other vulnerabilities affecting the same vendor(s)