Access Control Flaw in Keycloak Authorization by Red Hat
CVE-2026-9799

4.6MEDIUM

Key Information:

Vendor

Red Hat
Status
Red Hat Build Of Keycloak 26.4
Red Hat Build Of Keycloak 26.4.13
Red Hat Build Of Keycloak 26.6
Red Hat Build Of Keycloak 26.6.4
Vendor
CVE Published:
25 June 2026

What is CVE-2026-9799?

A vulnerability exists in Keycloak's authorization component that allows authenticated users with specific User-Managed Access (UMA) tickets to bypass resource-specific access controls. By utilizing a predetermined permission request prefix, an attacker can gain unauthorized access to all resources of a specific type within a resource server where PERMISSIVE policy enforcement is enabled. This misconfiguration permits the exploit, leading to potential unauthorized information disclosure and modification, particularly affecting resources with ownerManagedAccess enabled but lacking explicit policy protection.

Affected Version(s)

Red Hat build of Keycloak 26.4 26.4.13-1

Red Hat build of Keycloak 26.4 26.4-19

Red Hat build of Keycloak 26.4 26.4-19

References

https://access.redhat.com/errata/RHSA-2026:30049
vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:30050
vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:30083
vendor-advisoryx_refsource_REDHAT

CVSS V3.1

Score:
4.6
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Red Hat would like to thank Omaroo Baniessa for reporting this issue.
.