Aller au contenu
en Se connecter
7.7 Élevée

CVE-2026-9099 A flaw was found in Keycloak

Description

A flaw was found in Keycloak. A missing authorization check in the GroupResource.addChild() endpoint within the Admin REST API allows an authenticated user with limited administrative privileges to reparent any existing group. When Fine-Grained Admin Permissions v2 (FGAPv2) is enabled, an attacker with management rights over a single low-privilege group can reparent a highly privileged group (such as one possessing the realm-admin role) under their managed group. Because group permissions follow a hierarchical structure, this action unauthorizedly grants the attacker management and password-reset capabilities over the members of the targeted privileged group. An attacker can exploit this to reset an administrator's password, compromise the account, and achieve a full realm takeover, leading to a complete compromise of confidentiality, integrity, and availability.

Produits et versions touchés

Produit Versions touchées Corrigé en
Red Hat Build of Keycloak Versions non publiées
Red Hat build of Keycloak 26.6 26.6 premières → < 26.6-8 26.6-8
Red Hat build of Keycloak 26.6.4 Versions non publiées
Red Hat build of Keycloak 26.4 26.4 premières → < 26.4-19 26.4-19
Red Hat build of Keycloak 26.4.13 Versions non publiées

Références

Chronologie

  1. Publiée
  2. Dernière modification

Autres CVE de Red Hat Build of Keycloak

Les 276 CVE de Red Hat Build of Keycloak →
CVE-2026-9797 Keycloak: keycloak: privilege escalation via client authentication manipulation by an authenticated administrator 6.5 Moyenne CVE-2026-97848 Keycloak-services: keycloak-services: protocol mapper with jsontype=json bypasses token sanitization 6.5 Moyenne CVE-2026-97367 Keycloak-services: keycloak-services: dcr azp and sid claim substitution allows account rest session takeover 6.4 Moyenne CVE-2026-96547 Keycloak-services: keycloak-services: dcr registration-time claim-path gap allows forging realm_access.roles 6.5 Moyenne
Suivre cette CVE