CVE-2026-9099 Details

A vulnerability exists in Keycloak due to a missing authorization check in the GroupResource.addChild() endpoint of the Admin REST API. This flaw enables an authenticated user with limited administrative rights to reparent any existing group. When Fine-Grained Admin Permissions v2 (FGAPv2) is activated, an attacker managing a low-privilege group can move a high-privilege group, such as one with the realm-admin role, under their control. This unauthorized action grants the attacker management and password-reset rights over the members of the privileged group, potentially allowing them to reset an administrator's password, compromise the account, and take full control of the realm.

To address this vulnerability, restrict network access to the Keycloak Admin REST API to trusted networks or localhost. This will prevent unauthorized access to the API endpoints that could be exploited. Consult network security documentation for specific firewall or access control configurations. Note that this may affect remote administration capabilities.