CVE-2026-9799

CVE-2026-9799 is a medium-severity vulnerability in Redhat Build Of Keycloak with a CVSS 3.x base score of 4.6. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-639.

Key facts

Description

A flaw was found in org.keycloak.authorization. An authenticated user with a granted User-Managed Access (UMA) permission ticket for one resource can exploit this by using a specific permission request prefix to bypass per-resource access control. This allows the user to gain unauthorized access to all resources of that type within the same resource server, even if they do not have a ticket for those specific resources. This vulnerability requires the resource server to be configured in PERMISSIVE policy enforcement mode and affects typed resources with ownerManagedAccess enabled, where no explicit policy protects the resource type. The primary consequence is unauthorized information disclosure or modification of resources.

Frequently asked questions

What is CVE-2026-9799?
A flaw was found in org.keycloak.authorization. An authenticated user with a granted User-Managed Access (UMA) permission ticket for one resource can exploit this by using a specific permission request prefix to bypass per-resource access control. This allows the user to gain unauthorized access to all resources of that type within the same resource server, even if they do not have a ticket for those specific resources. This vulnerability requires the resource server to be configured in PERMISSIVE policy enforcement mode and affects typed resources with ownerManagedAccess enabled, where no explicit policy protects the resource type. The primary consequence is unauthorized information disclosure or modification of resources.
How severe is CVE-2026-9799?
CVE-2026-9799 has a CVSS 3.x base score of 4.6, rated medium severity. It is exploitable over network with low attack complexity, requires low privileges and user interaction. Impact on confidentiality is low, integrity low, and availability none.
Is CVE-2026-9799 being actively exploited?
It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (6th percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2026-9799?
CVE-2026-9799 affects Redhat Build Of Keycloak. See the affected-products list for the exact vulnerable versions.
How do I fix CVE-2026-9799?
Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
Does CVE-2026-9799 have an EU (EUVD) identifier?
Yes. CVE-2026-9799 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2026-39475.
When was CVE-2026-9799 published?
CVE-2026-9799 was published on 2026-06-25 and last updated on 2026-07-01.

References

Affected products (1)

More vulnerabilities in Redhat Build Of Keycloak

All CVEs affecting Redhat Build Of Keycloak →

Other CWE-639 (Authorization Bypass Through User-Controlled Key (IDOR)) vulnerabilities

Browse all CWE-639 (Authorization Bypass Through User-Controlled Key (IDOR)) vulnerabilities →