CVE-2026-9799

Vendor solution

To mitigate this issue, ensure that the Keycloak client's policy enforcement mode is set to ENFORCING instead of PERMISSIVE. The PERMISSIVE mode is a non-default configuration that enables the vulnerability. Changing this setting will prevent the unauthorized access to resources of the same type. Consult Keycloak documentation for specific instructions on configuring policy enforcement mode for your client. This change may require a restart or reload of the Keycloak service to take effect and could impact existing authorization policies if not carefully managed.

Red Hat statement

A Medium severity flaw exists in Keycloak's authorization component where a user with a UMA permission ticket for a specific resource type can gain unauthorized access to all resources of that type. This bypass occurs when the resource server is configured with the non-default PERMISSIVE policy enforcement mode, has ownerManagedAccess enabled for typed resources, and lacks a covering policy for the resource type. Exploitation requires an authenticated user with an existing permission ticket, limiting its impact to specific, non-default Keycloak deployments.

Red Hat mitigation

To mitigate this issue, ensure that the Keycloak client's policy enforcement mode is set to ENFORCING instead of PERMISSIVE. The PERMISSIVE mode is a non-default configuration that enables the vulnerability. Changing this setting will prevent the unauthorized access to resources of the same type. Consult Keycloak documentation for specific instructions on configuring policy enforcement mode for your client. This change may require a restart or reload of the Keycloak service to take effect and could impact existing authorization policies if not carefully managed.