CVE-2026-18203: Keycloak-services: keycloak-services: group policy extendchildren matches sibling group path prefixes
A flaw was found in the group policy evaluation logic of Keycloak, an identity and access management solution. When a group policy is set to extend permissions to child groups, the system incorrectly uses a simple text-based prefix check to verify group membership. This allows a user who belongs to a different group with a similar starting name to bypass security checks and gain unauthorized access to administrative functions or protected resources.
Other sources
A flaw was found in the org.keycloak.authorization component of Keycloak. When a group policy is configured with the extendChildren option enabled, the authorization engine performs a raw string prefix match on group paths to determine if a user satisfies the policy requirements. Because the check does not account for path delimiters, a user belonging to a sibling group whose path shares a prefix with the target group (for example, /group-sibling vs /group) is incorrectly granted access. An authenticated attacker with low privileges can exploit this by joining a prefix-colliding sibling group to gain elevated permissions, such as fine-grained admin access or authorization-services rights intended only for the target group and its descendants.
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-18203?
The severity of CVE-2026-18203 is classified as medium with a score of 6.5.
How do I fix CVE-2026-18203?
To fix CVE-2026-18203, ensure that group policy evaluations do not rely solely on text-based prefix checks and update the Keycloak configuration accordingly.
What are the potential impacts of CVE-2026-18203?
CVE-2026-18203 could potentially allow unauthorized access to resources by misusing group policies, affecting the integrity of access controls.
Which software is affected by CVE-2026-18203?
CVE-2026-18203 affects Keycloak services, specifically pertaining to the Keycloak authorization component.
When was CVE-2026-18203 published?
CVE-2026-18203 was published on July 29, 2026.