CVE-2026-9800

Katalog CVE

CVSS 8.1 · High EPSS 0,65%

Kerentanan Comparison Using Wrong Factors pada redhat build of keycloak. Skor CVSS 3.1 8.1 (High) menurut redhat.com.

Deskripsi (NVD)

A flaw was found in Keycloak Policy Enforcer. This vulnerability allows any authenticated user to bypass all authorization policies, including role, scope, and User-Managed Access (UMA) permission checks. By including the configured access-denied page path within a request URL, either as a path segment or a query parameter, an attacker can gain unauthorized access to protected resources.

Rincian

Terbit di NVD

25 Juni 2026

Terakhir diubah

14 September 2026

Status NVD

Modified

CVSS 3.1

8.1 (High), sumber redhat.com
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-1025: Comparison Using Wrong Factors

EPSS (30 hari)

0,65% peluang dieksploitasi; lebih tinggi dari 49,8% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://access.redhat.com/errata/RHSA-2026:30049 advisory vendor
• https://access.redhat.com/errata/RHSA-2026:30050 advisory vendor
• https://access.redhat.com/errata/RHSA-2026:30083 advisory vendor
• https://access.redhat.com/errata/RHSA-2026:30084 advisory vendor
• https://access.redhat.com/security/cve/CVE-2026-9800 advisory vendor
• https://bugzilla.redhat.com/show_bug.cgi?id=2482472 advisory vendor
• https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-9800.json advisory vendor
• https://access.redhat.com/errata/RHSA-2026:36002
• https://access.redhat.com/errata/RHSA-2026:36013
• https://access.redhat.com/errata/RHSA-2026:50846
• https://access.redhat.com/errata/RHSA-2026:50847