CVE-2026-9099

Name of the Vulnerable Software and Affected Versions Keycloak (affected versions not specified)

Description A missing authorization check in the GroupResource.addChild() endpoint within the Admin REST API allows an authenticated user with limited administrative privileges to reparent any existing group. When Fine-Grained Admin Permissions v2 (FGAPv2) is enabled, an attacker with management rights over a single low-privilege group can reparent a highly privileged group under their managed group. Since group permissions follow a hierarchical structure, this allows the attacker to gain unauthorized management and password-reset capabilities over members of the privileged group, potentially leading to a full realm takeover.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.