CVE-2026-18570 is a missing authorization vulnerability in Red Hat Build of Keycloak's full-scope-disabled client-policy executor. The executor enforces security policies during client registration and configuration but only validates the fullScopeAllowed field when it is explicitly included in requests. By omitting this field, an attacker with delegated user privileges can bypass the policy, resulting in a client being created with full scope access. This allows the client to obtain tokens containing unauthorized role mappings, potentially leading to privilege escalation within the system.

The vulnerability allows a delegated user to bypass client policy enforcement and create clients with full scope access, enabling unauthorized role mappings in tokens. This could lead to unauthorized access or privilege escalation within applications relying on Keycloak for authentication and authorization. The impact is limited to confidentiality and integrity, with no availability impact reported.

Patch status is not yet confirmed — check the vendor advisory at https://access.redhat.com/security/cve/CVE-2026-18570 for current remediation guidance. No official fix or workaround is stated in the provided advisory content. Until a patch is available, review client registration policies and restrict delegated user permissions to minimize risk.