Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
7.7
CVE-2026-9099: Keycloak: Limited User Can Reparent Privileged Groups
CVE-2026-9099 · published 4 months ago
Summary
An authenticated user with limited admin privileges can reparent groups, gaining management and password-reset capabilities over other users. This can lead to a complete takeover of the system, compromising confidentiality, integrity, and availability. To fix this, update to the latest version of Keycloak, as the issue is addressed in the latest release.
What to do
- Update keycloak to version 26.6.4.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| – | red hat | red hat build of keycloak 26.4 | All versions |
| – | red hat | red hat build of keycloak 26.4.13 | All versions |
| – | red hat | red hat build of keycloak 26.6 | All versions |
| – | red hat | red hat build of keycloak 26.6.4 | All versions |
| – | redhat | build_of_keycloak |
>= 26.4, < 26.4.13 >= 26.6, < 26.6.4 cpe:2.3:a:redhat:build_of_keycloak:*:*:*:*:*:*:*:* |
| Bitnami | – | keycloak |
>= 26.6.0, < 26.6.4 Fix: upgrade to 26.6.4
|
Original advisory text
Keycloak: group-admin escalation to realm-admin
A flaw was found in Keycloak. A missing authorization check in the GroupResource.addChild() endpoint within the Admin REST API allows an authenticated user with limited administrative privileges to reparent any existing group. When Fine-Grained Admin Permissions v2 (FGAPv2) is enabled, an attacker with management rights over a single low-privilege group can reparent a highly privileged group (such as one possessing the realm-admin role) under their managed group.
Because group permissions follow a hierarchical structure, this action unauthorizedly grants the attacker management and password-reset capabilities over the members of the targeted privileged group. An attacker can exploit this to reset an administrator's password, compromise the account, and achieve a full realm takeover, leading to a complete compromise of confidentiality, integrity, and availability.
Because group permissions follow a hierarchical structure, this action unauthorizedly grants the attacker management and password-reset capabilities over the members of the targeted privileged group. An attacker can exploit this to reset an administrator's password, compromise the account, and achieve a full realm takeover, leading to a complete compromise of confidentiality, integrity, and availability.
References
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-9099.json Third Party Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-9099 URL
- https://access.redhat.com/errata/RHSA-2026:30049 Third Party Advisory
- https://access.redhat.com/errata/RHSA-2026:30050 Third Party Advisory
- https://access.redhat.com/errata/RHSA-2026:30083 Third Party Advisory
- https://access.redhat.com/errata/RHSA-2026:30084 Third Party Advisory
- https://access.redhat.com/security/cve/CVE-2026-9099 Third Party Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2480182 Third Party Advisory
Internet-facing
14 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker full control
Type
CWE-639Authorization Bypass Through User-Controlled Key
Timeline
Published25 Jun 2026
Updated4 Nov 2026
First seen25 Jun 2026
Track software like this
Free during beta