This vulnerability arises from a flaw in the org.keycloak.authorization component of Red Hat Build of Keycloak. An authenticated user granted a UMA permission ticket for a specific resource can exploit a crafted permission request prefix to bypass access controls that are intended to restrict access on a per-resource basis. The bypass is possible only if the resource server is in PERMISSIVE policy enforcement mode and the resource type is ownerManagedAccess enabled without explicit policies. The result is unauthorized access to all resources of that type on the resource server, even without tickets for those resources.

The vulnerability allows unauthorized information disclosure and modification of resources within the affected resource server. The attacker must be authenticated and have a UMA permission ticket for at least one resource. The scope of unauthorized access extends to all resources of the same type on the resource server under the specified configuration conditions. There is no indication of availability impact. The CVSS 3.1 base score is 4.6 (medium), reflecting low complexity and privileges required but limited impact scope.

Patch status is not yet confirmed — check the vendor advisory at https://access.redhat.com/security/cve/CVE-2026-9799 for current remediation guidance. Since the vulnerability requires the resource server to be in PERMISSIVE policy enforcement mode and specific configuration conditions, a temporary mitigation could be to avoid using PERMISSIVE mode or ensure explicit policies protect resource types with ownerManagedAccess enabled. Follow Red Hat's official advisory for updates and patches.