AIKIDO-2026-584823

TL;DR

Keycloak's authorization services let a user holding a User-Managed Access permission ticket for one resource use a specific permission request prefix to bypass per-resource checks. This grants access to all resources of the same type on the resource server, even without a ticket for them. It applies to resource servers in PERMISSIVE enforcement mode with owner-managed typed resources that have no explicit type policy, allowing unauthorized disclosure or modification. The fix enforces per-resource authorization for these permission requests.