Description
The Account REST API endpoint for deleting issued verifiable credentials does not validate that the supplied credential ID belongs to the authenticated user. The delete operation checks that the caller holds the required account role but then performs a global primary-key lookup and removal without scoping to the authenticated user's identity.
The list operation correctly scopes results to the authenticated user via getIssuedVerifiableCredentialsStreamByUser(user.getId()), but the delete operation does not apply the equivalent ownership filter. The underlying provider method operates by primary key without any user-scoping constraint.
This is inconsistent with the authorization pattern used by the list endpoint in the same resource class and should be corrected to enforce object-level authorization on all mutation operations.
Version affected
main / nightly (development version 999.0.0-SNAPSHOT). The affected class (AccountIssuedVerifiableCredentialResource) is not present in the latest release (26.6.3). Requires the oid4vc-vci feature flag and verifiableCredentialsEnabled=true on the realm.
Expected behavior
The delete endpoint should verify that the issued verifiable credential identified by credentialId belongs to the authenticated account user before performing the deletion. If the credential does not belong to the caller, the request should be rejected.
Actual behavior
The delete endpoint removes the issued verifiable credential entity by primary key regardless of which user owns it, as long as the caller holds the required account role.
Steps to reproduce
- Start Keycloak from
main with --features=oid4vc-vci
- Create a realm with
verifiableCredentialsEnabled=true
- Create two users (User A and User B) with
manage-account role
- Create an issued verifiable credential record for User B
- Authenticate as User A and call the account API delete endpoint with User B's credential ID
- Observe that User B's credential record is deleted despite User A having no ownership
This issue was originally tracked in the private repository. Migrated by @abstractj.
Description
The Account REST API endpoint for deleting issued verifiable credentials does not validate that the supplied credential ID belongs to the authenticated user. The delete operation checks that the caller holds the required account role but then performs a global primary-key lookup and removal without scoping to the authenticated user's identity.
The list operation correctly scopes results to the authenticated user via
getIssuedVerifiableCredentialsStreamByUser(user.getId()), but the delete operation does not apply the equivalent ownership filter. The underlying provider method operates by primary key without any user-scoping constraint.This is inconsistent with the authorization pattern used by the list endpoint in the same resource class and should be corrected to enforce object-level authorization on all mutation operations.
Version affected
main/ nightly (development version999.0.0-SNAPSHOT). The affected class (AccountIssuedVerifiableCredentialResource) is not present in the latest release (26.6.3). Requires theoid4vc-vcifeature flag andverifiableCredentialsEnabled=trueon the realm.Expected behavior
The delete endpoint should verify that the issued verifiable credential identified by
credentialIdbelongs to the authenticated account user before performing the deletion. If the credential does not belong to the caller, the request should be rejected.Actual behavior
The delete endpoint removes the issued verifiable credential entity by primary key regardless of which user owns it, as long as the caller holds the required account role.
Steps to reproduce
mainwith--features=oid4vc-vciverifiableCredentialsEnabled=truemanage-accountroleThis issue was originally tracked in the private repository. Migrated by @abstractj.