Detections
Analytics

SCA: security update for org.keycloak:keycloak-services (GHSA-w3p3-7cjg-vgfw)

medium Tenable Self-Hosted Container Security Plugin ID 477903

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - A flaw was found in org.keycloak.authorization. An authenticated user with a granted User-Managed Access
 (UMA) permission ticket for one resource can exploit this by using a specific permission request prefix to
 bypass per-resource access control. This allows the user to gain unauthorized access to all resources of
 that type within the same resource server, even if they do not have a ticket for those specific resources.
 This vulnerability requires the resource server to be configured in PERMISSIVE policy enforcement mode and
 affects typed resources with ownerManagedAccess enabled, where no explicit policy protects the resource
 type. The primary consequence is unauthorized information disclosure or modification of resources.
 (CVE-2026-9799)

Solution

Update the org.keycloak:keycloak-services library and its related packages to version 26.6.4 or later.

See Also

https://github.com/advisories/GHSA-w3p3-7cjg-vgfw

Plugin Details

Severity: Medium

ID: 477903

Version: Revision 1.1

Type: Local

Family: SCA Checks

Published: 10/29/2026

Updated: 10/29/2026

Risk Information

VPR

Risk Factor: Low

Score: 2.1

Percentile: 7.77

Vendor

Vendor Severity: Medium

CVSS v2

Risk Factor: Medium

Base Score: 5.5

Temporal Score: 4.1

Vector: CVSS2#AV:N/AC:L/Au:S/C:P/I:P/A:N

CVSS Score Source: CVE-2026-9799

CVSS v3

Risk Factor: Medium

Base Score: 4.6

Temporal Score: 4

Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 10/29/2026

Vulnerability Publication Date: 6/25/2026

Reference Information

CVE: CVE-2026-9799

cwe: CWE-639