CVE-2026-9799: Authorization Bypass Through User-Controlled Key in Red Hat Red Hat build of Keycloak 26.4
A flaw was found in org.keycloak.authorization. An authenticated user with a granted User-Managed Access (UMA) permission ticket for one resource can exploit this by using a specific permission request prefix to bypass per-resource access control. This allows the user to gain unauthorized access to all resources of that type within the same resource server, even if they do not have a ticket for those specific resources. This vulnerability requires the resource server to be configured in PERMISSIVE policy enforcement mode and affects typed resources with ownerManagedAccess enabled, where no explicit policy protects the resource type. The primary consequence is unauthorized information disclosure or modification of resources.
AI Analysis
Technical Summary
The vulnerability exists in the org.keycloak.authorization component of Red Hat build of Keycloak 26.4. When the resource server is configured with PERMISSIVE policy enforcement mode and typed resources have ownerManagedAccess enabled without explicit policies, an authenticated user possessing a UMA permission ticket for one resource can exploit a crafted permission request prefix to bypass access controls. This bypass grants unauthorized access to all resources of that type within the same resource server, potentially exposing or allowing modification of resources beyond the user's granted permissions. The CVSS 3.1 base score is 4.6 (medium severity), reflecting low complexity and low privileges required, with impact on confidentiality and integrity but no availability impact. The vendor advisory does not explicitly state a patch or fix availability for this specific CVE but references a security update release (Red Hat build of Keycloak 26.4.13) that addresses multiple vulnerabilities including CVE-2026-9799.
Potential Impact
Exploitation of this vulnerability allows an authenticated user with limited UMA permission tickets to gain unauthorized access to all resources of the same type within the resource server. This leads to unauthorized disclosure and potential modification of resources that the user should not have access to. The impact affects confidentiality and integrity of resources managed by Keycloak authorization services when configured in PERMISSIVE mode with ownerManagedAccess enabled and no explicit policies protecting resource types.
Mitigation Recommendations
Red Hat has released updated packages for Red Hat build of Keycloak 26.4.13 that address CVE-2026-9799 along with other vulnerabilities. Users should apply these updates as provided by Red Hat to remediate the issue. Before updating, back up existing installations including applications, configuration files, and databases. No alternative mitigations or workarounds are explicitly stated in the vendor advisory. Patch status is confirmed by the vendor advisory referencing the 26.4.13 update release.
CVE-2026-9799: Authorization Bypass Through User-Controlled Key in Red Hat Red Hat build of Keycloak 26.4
Description
A flaw was found in org.keycloak.authorization. An authenticated user with a granted User-Managed Access (UMA) permission ticket for one resource can exploit this by using a specific permission request prefix to bypass per-resource access control. This allows the user to gain unauthorized access to all resources of that type within the same resource server, even if they do not have a ticket for those specific resources. This vulnerability requires the resource server to be configured in PERMISSIVE policy enforcement mode and affects typed resources with ownerManagedAccess enabled, where no explicit policy protects the resource type. The primary consequence is unauthorized information disclosure or modification of resources.
CVSS v3.1
Score 4.6medium
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The vulnerability exists in the org.keycloak.authorization component of Red Hat build of Keycloak 26.4. When the resource server is configured with PERMISSIVE policy enforcement mode and typed resources have ownerManagedAccess enabled without explicit policies, an authenticated user possessing a UMA permission ticket for one resource can exploit a crafted permission request prefix to bypass access controls. This bypass grants unauthorized access to all resources of that type within the same resource server, potentially exposing or allowing modification of resources beyond the user's granted permissions. The CVSS 3.1 base score is 4.6 (medium severity), reflecting low complexity and low privileges required, with impact on confidentiality and integrity but no availability impact. The vendor advisory does not explicitly state a patch or fix availability for this specific CVE but references a security update release (Red Hat build of Keycloak 26.4.13) that addresses multiple vulnerabilities including CVE-2026-9799.
Potential Impact
Exploitation of this vulnerability allows an authenticated user with limited UMA permission tickets to gain unauthorized access to all resources of the same type within the resource server. This leads to unauthorized disclosure and potential modification of resources that the user should not have access to. The impact affects confidentiality and integrity of resources managed by Keycloak authorization services when configured in PERMISSIVE mode with ownerManagedAccess enabled and no explicit policies protecting resource types.
Mitigation Recommendations
Red Hat has released updated packages for Red Hat build of Keycloak 26.4.13 that address CVE-2026-9799 along with other vulnerabilities. Users should apply these updates as provided by Red Hat to remediate the issue. Before updating, back up existing installations including applications, configuration files, and databases. No alternative mitigations or workarounds are explicitly stated in the vendor advisory. Patch status is confirmed by the vendor advisory referencing the 26.4.13 update release.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- redhat
- Date Reserved
- 2026-05-28T03:53:25.960Z
- Cvss Version
- 3.1
- State
- PUBLISHED
- Remediation Level
- null
- Vendor Advisory Urls
- [{"url":"https://access.redhat.com/security/cve/CVE-2026-9799","vendor":"Red Hat"}]
Threat ID: 6a3d5b514853345fc13372d9
Added to database: 06/25/2026, 16:46:09 UTC
Last enriched: 07/02/2026, 22:42:39 UTC
Last updated: 08/09/2026, 00:41:16 UTC
Views: 101
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.