CVE-2026-9799: Red Hat Keycloak authorization bypass in UMA permission tickets

CVE-2026-9799 · Severity: medium · CVSS 4.6 · Published 2026-06-25

A security flaw in Keycloak's authorization component allows an authenticated user to bypass access controls for certain resources. By using a specific request format, a user who has permission for one item can gain unauthorized access to all other items of the same type on the server. This could lead to the unauthorized viewing or modification of sensitive data managed by the identity provider.

Technologies: org.keycloak:keycloak-services (Maven). Vendors: Maven.

Quick answers

Is CVE-2026-9799 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-9799 being exploited in the wild.
How severe is CVE-2026-9799?
Medium severity, with a CVSS score of 4.6, published 25 June 2026.
Which products and versions are affected?
org.keycloak:keycloak-services (Maven) < 26.6.4, ECOSYSTEM:introduced=0,fixed=26.6.4.
Is there a fix for CVE-2026-9799?
Yes. org.keycloak:keycloak-services (Maven): upgrade to 26.6.4 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-9799 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-9799?
Check whether you run org.keycloak:keycloak-services (Maven) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • org.keycloak:keycloak-services (Maven): upgrade to 26.6.4 or later
    # set org.keycloak:keycloak-services to 26.6.4 in your pom.xml or build.gradle

Technical details

A vulnerability exists in the org.keycloak.authorization component of Keycloak due to improper validation of User-Managed Access (UMA) permission requests. An authenticated attacker with a valid permission ticket for a single resource can use a specific permission request prefix to bypass per-resource access controls. This allows unauthorized access to all resources of that type within the same resource server. The vulnerability specifically affects environments where the resource server is in PERMISSIVE policy enforcement mode, ownerManagedAccess is enabled for typed resources, and no explicit policy protects the resource type. This can result in unauthorized information disclosure or modification.

Affected products

  • Red Hat Keycloak Red Hat Build of Keycloak

Identifiers

  • CVE-2026-9799
  • BIT-KEYCLOAK-2026-9799
  • GHSA-w3p3-7cjg-vgfw

Timeline

  • 2026-05-28: other: Reported to Red Hat Bugzilla
  • 2026-06-25: disclosed: CVE published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.