CVE-2026-9799

Name of the Vulnerable Software and Affected Versions Keycloak (affected versions not specified)

Description A flaw in org.keycloak.authorization allows an authenticated user who possesses a User-Managed Access (UMA) permission ticket for a single resource to bypass per-resource access control. By using a specific permission request prefix, the user can gain unauthorized access to all resources of the same type within the same resource server. This occurs when the resource server is configured in PERMISSIVE policy enforcement mode and affects typed resources with ownerManagedAccess enabled that lack an explicit protecting policy. This can lead to unauthorized information disclosure or modification of resources.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.