The vulnerability in Red Hat Build of Keycloak arises from a missing authorization check in the GroupResource.addChild() endpoint of the Admin REST API. An authenticated user with limited administrative privileges can reparent any existing group. With Fine-Grained Admin Permissions v2 enabled, an attacker managing a low-privilege group can reparent a highly privileged group (e.g., one with realm-admin role) under their group. Because group permissions are hierarchical, this grants the attacker management and password-reset capabilities over the privileged group's members, enabling them to reset administrator passwords and achieve full realm compromise, affecting confidentiality, integrity, and availability.

Successful exploitation allows an attacker with limited administrative privileges to escalate their control by reparenting highly privileged groups under their own, thereby gaining management and password-reset capabilities over privileged users. This can lead to resetting administrator passwords and a complete realm takeover, resulting in full compromise of confidentiality, integrity, and availability of the affected Keycloak realm.

Patch status is not yet confirmed — check the vendor advisory at https://access.redhat.com/security/cve/CVE-2026-9099 for current remediation guidance. Until an official fix is available, restrict administrative privileges carefully and monitor for suspicious group reparenting activities. Avoid enabling Fine-Grained Admin Permissions v2 if possible until patched.