This vulnerability involves a TOCTOU race condition in the name-based administrative role checks within Red Hat's build of Keycloak. Specifically, an authenticated user with the 'manage-clients' role can exploit the timing flaw to escalate their privileges to 'realm-admin' across all users in the realm. The privilege escalation is persistent, remaining effective even after the attacker's initial permissions are revoked and after system reboots. The flaw impacts the integrity and confidentiality of the system by granting unauthorized administrative control. The CVSS 3.1 vector indicates network attack vector, low attack complexity, high privileges required, no user interaction, unchanged scope, and high impact on confidentiality and integrity but no impact on availability.

Successful exploitation results in privilege escalation from 'manage-clients' to 'realm-admin' for all users within the realm, granting extensive administrative control. This elevated access persists beyond revocation of the attacker's original permissions and system reboots, potentially allowing long-term unauthorized control. The vulnerability compromises confidentiality and integrity of the system but does not affect availability. No known exploits have been reported in the wild to date.

Patch status is not yet confirmed — check the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-9796 for current remediation guidance. Until an official fix is available, restrict 'manage-clients' role assignments to trusted administrators only and monitor for unusual privilege escalations. Follow vendor updates closely for patches or official mitigations.