CVE-2026-9099: Keycloak: group-admin escalation to realm-admin

Severity: high (CVSS 7.7 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.5% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-06-25 · updated 2026-07-15
Weakness: CWE-639

Description

A flaw was found in Keycloak. A missing authorization check in the GroupResource.addChild() endpoint within the Admin REST API allows an authenticated user with limited administrative privileges to reparent any existing group. When Fine-Grained Admin Permissions v2 (FGAPv2) is enabled, an attacker with management rights over a single low-privilege group can reparent a highly privileged group (such as one possessing the realm-admin role) under their managed group. Because group permissions follow a hierarchical structure, this action unauthorizedly grants the attacker management and password-reset capabilities over the members of the targeted privileged group. An attacker can exploit this to reset an administrator's password, compromise the account, and achieve a full realm takeover, leading to a complete compromise of confidentiality, integrity, and availability.

Affected products

Red Hat build of Keycloak 26.4: from 26.4 before 26.4.13; from 26.6 before 26.6.4 — fixed in 26.4.13, 26.6.4

How to fix

Upgrade to a fixed version: Red Hat build of Keycloak 26.4 26.4.13, 26.6.4. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2026-9099 or the next vulnerability affects your stack