HIGHVulnerability
Verified
Global

NVD HIGH: CVE-2026-9800 — A flaw was found in Keycloak Policy Enforcer. This vulnerability allows any auth...

·Source: NIST NVD

Updated:

Executive Summary

A flaw was found in Keycloak Policy Enforcer. This vulnerability allows any authenticated user to bypass all authorization policies, including role, scope, and User-Managed Access (UMA) permission checks. By including the configured access-denied page path within a request URL, either as a path segment or a query parameter, an attacker can gain unauthorized access to protected resources.

Analysis

A flaw was found in Keycloak Policy Enforcer. This vulnerability allows any authenticated user to bypass all authorization policies, including role, scope, and User-Managed Access (UMA) permission checks. By including the configured access-denied page path within a request URL, either as a path segment or a query parameter, an attacker can gain unauthorized access to protected resources. CVSS Score: 8.1. Published: 2026-06-25T17:17:04.180.

Indicators of Compromise (1)

CVE (1)
CVE-2026-9800
NVDMITRE CVE
Source Attribution

Originally published by NIST NVD on Jun 25, 2026. Verified by: NIST.

Related Threats

MEDIUMVulnerability

Quantifind Raises $200 Million for AI-Native Risk Intelligence

Quantifind will accelerate international expansion and extend its platform’s localized risk intelligence capabilities. The post Quantifind Raises $200 Million for AI-Native Risk Intelligence appeared first on SecurityWeek .

SecurityWeek
CRITICALVulnerability

NVD CRITICAL: CVE-2026-12073 — The ProfileGrid – User Profiles, Groups and Communities plugin for WordPress is ...

The ProfileGrid – User Profiles, Groups and Communities plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 5.9.9.5. This is due to the plugin not validating a `user_login` on registration forms that don't contain this parameter, and not properly handling the error messages. This makes it possible for unauthenticated attackers to ch

CVE-2026-12073
NIST NVD
LOWVulnerability

New Controller Flaws Expose Highway Signs and Billboards to Remote Hacking

CISA has published an advisory to inform organizations about three vulnerabilities found by a researcher in Daktronics controllers. The post New Controller Flaws Expose Highway Signs and Billboards to Remote Hacking appeared first on SecurityWeek .

SecurityWeek