CVE-2026-9799

[CVE catalog]

Severity

Medium · CVSS 4.6CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N

Published

May 19, 2026, 12:34:00 PM UTC

Source

[NVD] · [CVE record]

EPSS

0.29% · Oct 25, 2026

A flaw was found in org.keycloak.authorization. An authenticated user with a granted User-Managed Access (UMA) permission ticket for one resource can exploit this by using a specific permission request prefix to bypass per-resource access control. This allows the user to gain unauthorized access to all resources of that type within the same resource server, even if they do not have a ticket for those specific resources. This vulnerability requires the resource server to be configured in PERMISSIVE policy enforcement mode and affects typed resources with ownerManagedAccess enabled, where no explicit policy protects the resource type. The primary consequence is unauthorized information disclosure or modification of resources. keycloak: Keycloak: Unauthorized access to resources via UMA permission ticket bypass A Medium severity flaw exists in Keycloak's authorization component where a user with a UMA permission ticket for a specific resource type can gain unauthorized access to all resources of that type. This bypass occurs when the resource server is configured with the non-default PERMISSIVE policy enforcement mode, has ownerManagedAccess enabled for typed resources, and lacks a covering policy for the resource type. Exploitation requires an authenticated user with an existing permission ticket, limiting its impact to specific, non-default Keycloak deployments. The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.