Executive Summary

CVE-2026-9796 is a vulnerability in Keycloak involving a Time-of-Check to Time-of-Use (TOCTOU) flaw.

An authenticated administrator who has the `manage-clients` role can exploit this flaw to escalate their privileges to `realm-admin` for all users within the realm.

This escalation grants the attacker extensive control over the system.

The vulnerability arises from name-based admin role checks and the elevated privileges persist even after the attacker's own permissions are revoked and across system reboots.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows an attacker with limited administrative rights to gain full administrative control over the Keycloak realm.

With `realm-admin` privileges, the attacker can manage all users and configurations within the realm, potentially compromising the entire authentication and authorization system.

Since the elevated privileges persist even after revocation and system reboots, the attacker can maintain long-term unauthorized access and control.

Useful 0 Not Useful 0

Compliance Impact

The vulnerability allows an authenticated administrator with limited privileges to escalate to full realm-admin privileges, gaining extensive control over the system. This unauthorized privilege escalation can lead to unauthorized access and potential misuse of sensitive data.

Such unauthorized access and control could impact compliance with common standards and regulations like GDPR and HIPAA, which require strict access controls and protection of personal and sensitive data.

Because the attacker retains elevated privileges even after their original permissions are revoked and across system reboots, this persistent unauthorized access increases the risk of data breaches and non-compliance with regulatory requirements.

Useful 0 Not Useful 0