CVE-2026-9796

MEDIUM

MEDIUM Priority: 0.01 BB Relevance: 58/100

Published: 2026-05-28 Modified: 2026-10-26 First seen: 2026-10-29 Status: active

Attack Surface

Network Low Complexity No Interaction Conf. Impact Integ. Impact

CVSS Vector Breakdown

AV: Network

AC: Low

PR: High

UI: None

S: Unchanged

C: High

I: High

A: None

Description

A flaw was found in Keycloak. An authenticated administrator with the `manage-clients` role can exploit a Time-of-check to time-of-use (TOCTOU) vulnerability in the name-based admin role checks. This allows the attacker to escalate their privileges to `realm-admin` for all users within the realm, granting them extensive control over the system. The composite role relationship persists even after the attacker's own permissions are revoked and across system reboots.