CVE-2026-9800
High · 8.1CVSS
8.1
EPSS
0.7%
Published
Jun 25, 2026
CISA due date
—
The record
A flaw was found in Keycloak Policy Enforcer. This vulnerability allows any authenticated user to bypass all authorization policies, including role, scope, and User-Managed Access (UMA) permission checks. By including the configured access-denied page path within a request URL, either as a path segment or a query parameter, an attacker can gain unauthorized access to protected resources.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-78619 Punk::Plugin::TOTP versions before 0.05 for Perl accept another account's recovery code… CWE-1025
- CVE-2026-75840 ArcadeDB before 26.8.1 contains an arbitrary file read vulnerability in the GraalVM… CWE-1025
- CVE-2026-48860 Reliance on IP Address for Authentication vulnerability in Erlang/OTP ssl (inet_tls_dist… CWE-1025
- CVE-2026-40880 ZEBRA is a Zcash node written entirely in Rust. CWE-1025
- GHSA-xvj8-ph7x-65gf Zebra: Cached Mempool Verification Bypasses Consensus Rules for Ahead-of-Tip Blocks CWE-1025
- CVE-2026-40227 In systemd 260 before 261, a local unprivileged user can trigger an assert via an IPC API… CWE-1025
- CVE-2026-21691 iccDEV has Type Confusion in CIccTag:IsTypeCompressed() CWE-1025