CVE-2026-9799 Details

A vulnerability exists in the Keycloak authorization component, specifically in the User-Managed Access (UMA) permission handling. An authenticated user with a UMA permission ticket for one resource can exploit this flaw by using a certain permission request prefix to bypass access controls for individual resources. This exploitation grants unauthorized access to all resources of that type within the same resource server, regardless of whether the user has a ticket for those specific resources. The vulnerability arises when the resource server is set to PERMISSIVE policy enforcement mode, affects typed resources with ownerManagedAccess enabled, and lacks explicit policy protection for the resource type. The main consequence of this vulnerability is unauthorized access to information or the ability to modify resources.

To address this vulnerability, change the Keycloak client's policy enforcement mode from PERMISSIVE to ENFORCING. This adjustment will prevent unauthorized access to resources of the same type. Consult the Keycloak documentation for guidance on modifying the policy enforcement mode for your client. Note that this change may require restarting or reloading the Keycloak service and could affect existing authorization policies.