{"id":"CVE-2026-9796","aliases":["EUVD-2026-32716","GHSA-pq65-77rc-7r8c"],"status":"published","title":"Keycloak: keycloak: privilege escalation via time-of-check to time-of-use (toctou) vulnerability","description":"A flaw was found in Keycloak. An authenticated administrator with the `manage-clients` role can exploit a Time-of-check to time-of-use (TOCTOU) vulnerability in the name-based admin role checks. This allows the attacker to escalate their privileges to `realm-admin` for all users within the realm, granting them extensive control over the system. The composite role relationship persists even after the attacker's own permissions are revoked and across system reboots.","severity":{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00219,"percentile":0.12513,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-367"],"published":"2026-05-28T04:27:08Z","modified":"2026-10-26T12:10:00Z","fixes":[{"ecosystem":"Maven","package":"org.keycloak:keycloak-server","fixed_in":["26.6.4"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"org.keycloak:keycloak-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"26.6.4"}]}]},{"source":"osv","ecosystem":"Maven","package":"org.keycloak:keycloak-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"26.6.4"}]}],"versions":["1.0-alpha-1-12062013","1.0-final","1.0-rc-1","1.0-rc-2","1.0.1.Final","1.0.2.Final","1.0.3.Final","1.0.4.Final","1.0.5.Final","1.1.0.Beta1","1.1.0.Beta2","1.1.0.Final","1.1.1.Final","1.2.0.Beta1"]}],"products":[{"vendor":"red hat","product":"red hat build of keycloak"},{"vendor":"red hat","product":"red hat build of keycloak 26.6"},{"vendor":"red hat","product":"red hat build of keycloak 26.6.6"},{"vendor":"redhat","product":"build_of_keycloak"}],"references":[{"url":"https://access.redhat.com/errata/RHSA-2026:56523","tags":["vendor-advisory","x_refsource_REDHAT","web"]},{"url":"https://access.redhat.com/errata/RHSA-2026:56524","tags":["vendor-advisory","x_refsource_REDHAT","web"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-9796","tags":["vdb-entry","x_refsource_REDHAT","Vendor Advisory","web"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2482464","tags":["issue-tracking","x_refsource_REDHAT","Issue Tracking","Vendor Advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-9796","tags":["advisory"]},{"url":"https://github.com/keycloak/keycloak/issues/49427","tags":["web"]},{"url":"https://github.com/keycloak/keycloak/pull/49624","tags":["web"]},{"url":"https://github.com/keycloak/keycloak/commit/39cb8de54c8517efeda4baa8bc314fd40e9c6934","tags":["web"]},{"url":"https://github.com/advisories/GHSA-pq65-77rc-7r8c"},{"url":"https://github.com/keycloak/keycloak","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2026-9796","title":"Keycloak: keycloak: privilege escalation via time-of-check to time-of-use (toctou) vulnerability","description":"A flaw was found in Keycloak. An authenticated administrator with the `manage-clients` role can exploit a Time-of-check to time-of-use (TOCTOU) vulnerability in the name-based admin role checks. This allows the attacker to escalate their privileges to `realm-admin` for all users within the realm, granting them extensive control over the system. The composite role relationship persists even after the attacker's own permissions are revoked and across system reboots.","status":"published","published":"2026-05-28T04:27:08.794Z","modified":"2026-09-15T11:39:48.493Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-367"],"updated_at":"2026-11-02T13:42:37.965383Z"}],"euvd":[{"id":"EUVD-2026-32716","description":"A flaw was found in Keycloak. An authenticated administrator with the `manage-clients` role can exploit a Time-of-check to time-of-use (TOCTOU) vulnerability in the name-based admin role checks. This allows the attacker to escalate their privileges to `realm-admin` for all users within the realm, granting them extensive control over the system. The composite role relationship persists even after the attacker's own permissions are revoked and across system reboots.","status":"published","published":"2026-05-28T04:27:08Z","modified":"2026-09-15T11:39:48Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N","level":"medium"}],"updated_at":"2026-11-02T17:28:19.01786Z"}],"ghsa":[{"id":"GHSA-pq65-77rc-7r8c","title":"Keycloak has a Time-of-check Time-of-use (TOCTOU) Race Condition","description":"A flaw was found in Keycloak. An authenticated administrator with the `manage-clients` role can exploit a Time-of-check to time-of-use (TOCTOU) vulnerability in the name-based admin role checks. This allows the attacker to escalate their privileges to `realm-admin` for all users within the realm, granting them extensive control over the system. The composite role relationship persists even after the attacker's own permissions are revoked and across system reboots.","status":"published","published":"2026-05-28T06:31:09Z","modified":"2026-08-19T00:31:10Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N","level":"medium"}],"cwes":["CWE-367"],"updated_at":"2026-11-02T14:41:03.602876Z"}],"nvd":[{"id":"CVE-2026-9796","description":"A flaw was found in Keycloak. An authenticated administrator with the `manage-clients` role can exploit a Time-of-check to time-of-use (TOCTOU) vulnerability in the name-based admin role checks. This allows the attacker to escalate their privileges to `realm-admin` for all users within the realm, granting them extensive control over the system. The composite role relationship persists even after the attacker's own permissions are revoked and across system reboots.","status":"published","published":"2026-05-28T05:16:41.153Z","modified":"2026-10-26T12:10:00.13Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-367"],"updated_at":"2026-11-02T14:12:20.885865Z"}],"osv":[{"id":"GHSA-pq65-77rc-7r8c","title":"Keycloak has a Time-of-check Time-of-use (TOCTOU) Race Condition","description":"A flaw was found in Keycloak. An authenticated administrator with the `manage-clients` role can exploit a Time-of-check to time-of-use (TOCTOU) vulnerability in the name-based admin role checks. This allows the attacker to escalate their privileges to `realm-admin` for all users within the realm, granting them extensive control over the system. The composite role relationship persists even after the attacker's own permissions are revoked and across system reboots.","status":"published","published":"2026-05-28T06:31:09Z","modified":"2026-08-19T00:45:06.92461901Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N","level":"medium"}],"cwes":["CWE-367"],"updated_at":"2026-11-02T15:46:53.700556Z"}]}}