{"id":"CVE-2026-9800","title":"A flaw was found in Keycloak Policy Enforcer","summary":"A flaw was found in Keycloak Policy Enforcer. This vulnerability allows any authenticated user to bypass all authorization policies, including role, scope, and User-Managed Access (UMA) permission checks. By including the configured acce…","severity":"high","cvss":8.1,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","cwe":["CWE-1025"],"vendor":"redhat","product":"build_of_keycloak","affected":["build_of_keycloak >= 26.4, < 26.4.13","build_of_keycloak >= 26.6, <= 26.6.4"],"patched":["build_of_keycloak 26.4.13"],"published":"2026-06-25","updated":"2026-10-14","sourceUpdated":"2026-10-14T17:20:47.970","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-9800","references":[{"url":"https://access.redhat.com/errata/RHSA-2026:30049","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:30050","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:30083","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:30084","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:36002","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:36013","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:50846","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:50847","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/security/cve/CVE-2026-9800","label":"secalert@redhat.com"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2482472","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:30049","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:30050","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:30083","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:30084","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:50846","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:50847","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/security/cve/CVE-2026-9800","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2482472","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-9800.json","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-9800"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-9800"},{"url":"https://github.com/keycloak/keycloak/security/advisories/GHSA-f5p5-6xmx-p252"},{"url":"https://github.com/advisories/GHSA-f5p5-6xmx-p252"}],"tags":["nvd","cve.org","csaf","vex","red-hat","ghsa","maven"],"epss":0.00651,"epssPercentile":0.50973,"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"total","timestamp":"2026-06-25T17:27:58.852057Z"},"ingestedAt":"2026-08-06T20:03:56.292Z","aliases":["GHSA-f5p5-6xmx-p252"],"ecosystem":"maven","slug":"CVE-2026-9800","body":"## Overview\n\nA flaw was found in Keycloak Policy Enforcer. This vulnerability allows any authenticated user to bypass all authorization policies, including role, scope, and User-Managed Access (UMA) permission checks. By including the configured access-denied page path within a request URL, either as a path segment or a query parameter, an attacker can gain unauthorized access to protected resources.\n\n## Affected\n\n- `build_of_keycloak >= 26.4, < 26.4.13`\n- `build_of_keycloak >= 26.6, <= 26.6.4`\n\n## Remediation\n\nUpgrade past the affected range:\n\n- `build_of_keycloak 26.4.13`\n\n## Vendor advisories\n\n- **RHSA-2026:50847** · Red Hat · fixed in: Red Hat build of Keycloak 26.4 · released 2026-08-05 · [advisory](https://access.redhat.com/errata/RHSA-2026:50847)\n- **RHSA-2026:30050** · Red Hat · fixed in: Red Hat build of Keycloak 26.4 · released 2026-06-25 · [advisory](https://access.redhat.com/errata/RHSA-2026:30050)\n- **RHSA-2026:30084** · Red Hat · fixed in: Red Hat build of Keycloak 26.6 · released 2026-06-25 · [advisory](https://access.redhat.com/errata/RHSA-2026:30084)\n- **RHSA-2026:30049** · Red Hat · fixed in: Red Hat build of Keycloak 26.4.13 · released 2026-06-25 · [advisory](https://access.redhat.com/errata/RHSA-2026:30049)\n- **RHSA-2026:50846** · Red Hat · fixed in: Red Hat build of Keycloak 26.4.14 · released 2026-08-05 · [advisory](https://access.redhat.com/errata/RHSA-2026:50846)\n- **RHSA-2026:30083** · Red Hat · fixed in: Red Hat build of Keycloak 26.6.4 · released 2026-06-25 · [advisory](https://access.redhat.com/errata/RHSA-2026:30083)\n- **Red Hat VEX** · Important · affected: Red Hat build of Quarkus, Red Hat Single Sign-On 7 · no fix planned: Red Hat build of Quarkus, Red Hat Single Sign-On 7 · updated 2026-10-20 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-9800.json)\n- **RHSA-2026:36002** · Red Hat · fixed in: Red Hat build of Quarkus 3.27.4.SP2 · released 2026-07-08 · [advisory](https://access.redhat.com/errata/RHSA-2026:36002)\n- **RHSA-2026:36013** · Red Hat · fixed in: Red Hat build of Quarkus 3.33.2.SP2 · released 2026-07-08 · [advisory](https://access.redhat.com/errata/RHSA-2026:36013)\n\n## Package advisory (CVE-2026-9800)\n\nAffected packages:\n\n- `org.keycloak:keycloak-services < 26.6.4`\n- `org.keycloak:keycloak-policy-enforcer < 26.0.10`\n\nPatched in:\n\n- `org.keycloak:keycloak-services 26.6.4`\n- `org.keycloak:keycloak-policy-enforcer 26.0.10`\n\nSource: https://github.com/advisories/GHSA-f5p5-6xmx-p252","depth":"twilight","depthScore":45,"depthScoreParts":{"impact":44.6,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}