CVE-2026-9795

HIGH EPSS 20.3%
Published May 28, 20261mo ago · Modified Jun 17, 20261w ago
7.3 CVSS 3.1
High
Find Similar
Published May 28, 2026 1mo ago
Last Modified Jun 17, 2026 1w ago

Description

A flaw was found in Keycloak's Fine-Grained Admin Permissions (FGAPv2) feature. An administrator with limited client management permissions can exploit this vulnerability to assign any realm role, including highly privileged roles, to a client's scope mapping. This bypasses intended security controls, allowing the injected role to be projected into a user's authentication token when they access the modified client. This could lead to unauthorized privilege escalation within the Keycloak realm.

CVSS Details

Base Score
7.3
Exploitability
1.0
Impact
5.8
Vector string
CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:N
Attack Vector Network
Attack Complexity High
Privileges Required High
User Interaction Required
Scope Changed
Confidentiality High
Integrity High
Availability None

Threat Intelligence

EPSS Exploit Probability
20.3% percentile
Exploit & Patch Status
No Known Exploit
No Patch Available

Weaknesses 1

CWE-266

Affected Products 1

VendorProductVersionRange
redhatbuild_of_keycloak*any

References 2

  • access.redhat.com https://access.redhat.com/security/cve/CVE-2026-9795
    MitigationVendor Advisory
  • bugzilla.redhat.com https://bugzilla.redhat.com/show_bug.cgi?id=2482462
    Issue TrackingVendor Advisory

Remediation

No remediation data recorded yet

Check vendor advisories and the NVD entry for patch availability.