A flaw was found in Keycloak. A missing authorization check in the GroupResource.addChild() endpoint within the Admin REST API allows an authenticated user with limited administrative privileges to reparent any existing group. When Fine-Grained Admin Permissions v2 (FGAPv2) is enabled, an attacker with management rights over a single low-privilege group can reparent a highly privileged group (such as one possessing the realm-admin role) under their managed group.
Because group permissions follow a hierarchical structure, this action unauthorizedly grants the attacker management and password-reset capabilities over the members of the targeted privileged group. An attacker can exploit this to reset an administrator's password, compromise the account, and achieve a full realm takeover, leading to a complete compromise of confidentiality, integrity, and availability.
References
| Link | Resource |
|---|---|
| https://access.redhat.com/errata/RHSA-2026:30049 | Third Party Advisory |
| https://access.redhat.com/errata/RHSA-2026:30050 | Third Party Advisory |
| https://access.redhat.com/errata/RHSA-2026:30083 | Third Party Advisory |
| https://access.redhat.com/errata/RHSA-2026:30084 | Third Party Advisory |
| https://access.redhat.com/security/cve/CVE-2026-9099 | Third Party Advisory |
| https://bugzilla.redhat.com/show_bug.cgi?id=2480182 | Third Party Advisory |
| https://access.redhat.com/errata/RHSA-2026:30049 | Third Party Advisory |
| https://access.redhat.com/errata/RHSA-2026:30050 | Third Party Advisory |
| https://access.redhat.com/errata/RHSA-2026:30083 | Third Party Advisory |
| https://access.redhat.com/errata/RHSA-2026:30084 | Third Party Advisory |
| https://access.redhat.com/security/cve/CVE-2026-9099 | Third Party Advisory |
| https://bugzilla.redhat.com/show_bug.cgi?id=2480182 | Third Party Advisory |
| https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-9099.json | Third Party Advisory |
Configurations
Configuration 1 (hide)
|
History
01 Jul 2026, 17:23
| Type | Values Removed | Values Added |
|---|---|---|
| First Time |
Redhat build Of Keycloak
Redhat |
|
| References | () https://access.redhat.com/errata/RHSA-2026:30049 - Third Party Advisory | |
| References | () https://access.redhat.com/errata/RHSA-2026:30050 - Third Party Advisory | |
| References | () https://access.redhat.com/errata/RHSA-2026:30083 - Third Party Advisory | |
| References | () https://access.redhat.com/errata/RHSA-2026:30084 - Third Party Advisory | |
| References | () https://access.redhat.com/security/cve/CVE-2026-9099 - Third Party Advisory | |
| References | () https://bugzilla.redhat.com/show_bug.cgi?id=2480182 - Third Party Advisory | |
| References | () https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-9099.json - Third Party Advisory | |
| CPE | cpe:2.3:a:redhat:build_of_keycloak:*:*:*:*:*:*:*:* |
30 Jun 2026, 03:21
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
|
| References | () https://access.redhat.com/errata/RHSA-2026:30049 - | |
| References | () https://access.redhat.com/errata/RHSA-2026:30050 - | |
| References | () https://access.redhat.com/errata/RHSA-2026:30083 - | |
| References | () https://access.redhat.com/errata/RHSA-2026:30084 - | |
| References | () https://access.redhat.com/security/cve/CVE-2026-9099 - | |
| References | () https://bugzilla.redhat.com/show_bug.cgi?id=2480182 - |
26 Jun 2026, 08:16
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
25 Jun 2026, 20:17
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
25 Jun 2026, 17:17
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2026-06-25 17:17
Updated : 2026-07-15 01:17
NVD link : CVE-2026-9099
Mitre link : CVE-2026-9099
CVE.ORG link : CVE-2026-9099
JSON object : View
Products Affected
redhat
- build_of_keycloak
CWE
CWE-639
Authorization Bypass Through User-Controlled Key