# CVE-2026-9099: Keycloak privilege escalation via missing authorization in GroupResource

Source: https://junglewise.ai/threats/cve-2026-9099-keycloak-privilege-escalation-via-missing-authorization-in  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-25. Updated: 2026-06-25  
License: CC BY 4.0 with a link back

CVE-2026-9099 · Severity: high · CVSS 7.7 · Published 2026-06-25

A security flaw in Keycloak's identity management system allows a user with limited administrative access to take over the entire security realm. By exploiting a missing check in the group management interface, an attacker can move highly privileged groups under their own control. This allows the attacker to reset administrator passwords and gain full access to sensitive customer data and system configurations.

Technologies: [Red Hat build of Keycloak](https://junglewise.ai/threats/technologies/red-hat-build-of-keycloak). Vendors: [Red Hat](https://junglewise.ai/threats/vendors/red-hat).

## Quick answers

**Is CVE-2026-9099 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-9099 being exploited in the wild.

**How severe is CVE-2026-9099?** High severity, with a CVSS score of 7.7, published 25 June 2026.

**Which products and versions are affected?** Red Hat build of Keycloak Not specified.

**Is there a fix for CVE-2026-9099?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-9099 attacked?** It is attacked over the network, in a hosted service.

**Am I affected by CVE-2026-9099?** Check whether you run Red Hat build of Keycloak at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A vulnerability exists in the GroupResource.addChild() endpoint of the Keycloak Admin REST API due to a missing authorization check. When Fine-Grained Admin Permissions v2 (FGAPv2) is enabled, an authenticated attacker with management rights over at least one low-privilege group can reparent a highly privileged group (such as one with the realm-admin role) to be a child of their managed group. Because Keycloak group permissions are hierarchical, the attacker inherits management and password-reset capabilities over the members of the moved group. This allows for account takeover of high-privilege administrators and a complete compromise of the realm's confidentiality, integrity, and availability.

## Affected products

- Red Hat Keycloak Not specified
- Red Hat Red Hat Build of Keycloak Not specified

## Timeline

- 2026-05-20: other: Reported via Bugzilla
- 2026-06-25: disclosed: NVD publication date

## References

- [https://access.redhat.com/downloads/content/package-browser/](https://access.redhat.com/downloads/content/package-browser/)
- [https://access.redhat.com/security/cve/CVE-2026-9099](https://access.redhat.com/security/cve/CVE-2026-9099)
- [https://bugzilla.redhat.com/show_bug.cgi?id=2480182](https://bugzilla.redhat.com/show_bug.cgi?id=2480182)

## Related threats

- [Keycloak SAML HTTP Parameter Pollution in HTTP-Redirect binding](https://junglewise.ai/threats/cve-2026-18217-keycloak-saml-http-parameter-pollution-in-http-redirect-binding)
- [Keycloak keycloak-services improper wildcard domain validation in client policies](https://junglewise.ai/threats/cve-2026-18206-keycloak-keycloak-services-improper-wildcard-domain-validation-in)
- [Keycloak keycloak-services authorization bypass in role-users endpoint](https://junglewise.ai/threats/cve-2026-17059-keycloak-keycloak-services-authorization-bypass-in-role-users)
- [Red Hat Keycloak authorization bypass in FGAP v2 child group endpoint](https://junglewise.ai/threats/cve-2026-14615-red-hat-keycloak-authorization-bypass-in-fgap-v2-child-group)
- [Keycloak privilege escalation in Identity Provider mapper](https://junglewise.ai/threats/cve-2026-12388-keycloak-privilege-escalation-in-identity-provider-mapper)