{"id":"CVE-2026-9800","title":"A flaw was found in Keycloak Policy Enforcer","summary":"A flaw was found in Keycloak Policy Enforcer. This vulnerability allows any authenticated user to bypass all authorization policies, including role, scope, and User-Managed Access (UMA) permission checks. By including the configured acce…","severity":"high","cvss":8.1,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","cwe":["CWE-1025"],"vendor":"redhat","product":"build_of_keycloak","affected":["build_of_keycloak >= 26.4, < 26.4.13","build_of_keycloak >= 26.6, <= 26.6.4"],"patched":["build_of_keycloak 26.4.13"],"published":"2026-06-25","updated":"2026-09-14","sourceUpdated":"2026-09-14T13:19:33.747","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-9800","references":[{"url":"https://access.redhat.com/errata/RHSA-2026:30049","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:30050","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:30083","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:30084","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:36002","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:36013","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:50846","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:50847","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/security/cve/CVE-2026-9800","label":"secalert@redhat.com"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2482472","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:30049","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:30050","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:30083","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:30084","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:50846","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:50847","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/security/cve/CVE-2026-9800","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2482472","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-9800.json","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-9800"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-9800"}],"tags":["nvd","cve.org","csaf","vex","red-hat"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"total","timestamp":"2026-06-25T17:27:58.852057Z"},"epss":0.00651,"epssPercentile":0.49405,"ingestedAt":"2026-08-06T20:03:56.292Z","slug":"CVE-2026-9800","body":"## Overview\n\nA flaw was found in Keycloak Policy Enforcer. This vulnerability allows any authenticated user to bypass all authorization policies, including role, scope, and User-Managed Access (UMA) permission checks. By including the configured access-denied page path within a request URL, either as a path segment or a query parameter, an attacker can gain unauthorized access to protected resources.\n\n## Affected\n\n- `build_of_keycloak >= 26.4, < 26.4.13`\n- `build_of_keycloak >= 26.6, <= 26.6.4`\n\n## Remediation\n\nUpgrade past the affected range:\n\n- `build_of_keycloak 26.4.13`\n\n## Vendor advisories\n\n- **RHSA-2026:50847** · Red Hat · fixed in: Red Hat build of Keycloak 26.4 · released 2026-08-05 · [advisory](https://access.redhat.com/errata/RHSA-2026:50847)\n- **RHSA-2026:30050** · Red Hat · fixed in: Red Hat build of Keycloak 26.4 · released 2026-06-25 · [advisory](https://access.redhat.com/errata/RHSA-2026:30050)\n- **RHSA-2026:30084** · Red Hat · fixed in: Red Hat build of Keycloak 26.6 · released 2026-06-25 · [advisory](https://access.redhat.com/errata/RHSA-2026:30084)\n- **RHSA-2026:30049** · Red Hat · fixed in: Red Hat build of Keycloak 26.4.13 · released 2026-06-25 · [advisory](https://access.redhat.com/errata/RHSA-2026:30049)\n- **RHSA-2026:50846** · Red Hat · fixed in: Red Hat build of Keycloak 26.4.14 · released 2026-08-05 · [advisory](https://access.redhat.com/errata/RHSA-2026:50846)\n- **RHSA-2026:30083** · Red Hat · fixed in: Red Hat build of Keycloak 26.6.4 · released 2026-06-25 · [advisory](https://access.redhat.com/errata/RHSA-2026:30083)\n- **Red Hat VEX** · Important · affected: Red Hat Single Sign-On 7 · no fix planned: Red Hat Single Sign-On 7 · updated 2026-09-13 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-9800.json)","depth":"twilight","depthScore":45,"depthScoreParts":{"impact":44.6,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}