CVE-2026-9799
MediumCVSS 4.6Exploitation Probability (EPSS)
Low risk6th percentile — higher than 6% of all known CVEs
Summary
A flaw was found in the Keycloak authorization component. An authenticated user with a UMA permission ticket for one resource can bypass per-resource access control for all resources of the same type on the resource server by using a specific permission request prefix. This vulnerability requires PERMISSIVE policy enforcement mode and ownerManagedAccess enabled for typed resources without explicit policies.
Risk Assessment
The organization is at risk of unauthorized access to sensitive resources, potentially leading to information disclosure or data modification without proper authorization.
Recommendation
Immediately update Keycloak to a patched version, switch resource server policy enforcement mode to ENFORCING, and add explicit protection policies for typed resources.
Original NVD description (English source)
A flaw was found in org.keycloak.authorization. An authenticated user with a granted User-Managed Access (UMA) permission ticket for one resource can exploit this by using a specific permission request prefix to bypass per-resource access control. This allows the user to gain unauthorized access to all resources of that type within the same resource server, even if they do not have a ticket for those specific resources. This vulnerability requires the resource server to be configured in PERMISSIVE policy enforcement mode and affects typed resources with ownerManagedAccess enabled, where no explicit policy protects the resource type. The primary consequence is unauthorized information disclosure or modification of resources.