Bug 2508291 (CVE-2026-18203)

Summary:	CVE-2026-18203 keycloak-services: keycloak-services: Group policy extendChildren matches sibling group path prefixes
Product:	[Other] Security Response	Reporter:	OSIDB Bzimport <bzimport>
Component:	vulnerability	Assignee:	Product Security <prodsec-ir-bot>
Status:	NEW ---	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	anujha, aschwart, asoldano, aszczucz, bbaranow, bmaxwell, boliveir, bstansbe, dlofthou, drichtar, istudens, ivassile, iweiss, mosmerov, mposolda, msvehla, nwallace, pberan, pesilva, pjindal, pmackay, rmartinc, rstancel, ssilvert, sthorger, thjenkin, vdosoudi, vmuzikar
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	---
Doc Text:	A flaw was found in the group policy evaluation logic of Keycloak, an identity and access management solution. When a group policy is set to extend permissions to child groups, the system incorrectly uses a simple text-based prefix check to verify group membership. This allows a user who belongs to a different group with a similar starting name to bypass security checks and gain unauthorized access to administrative functions or protected resources.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-07-29 07:49:43 UTC

A flaw was found in the org.keycloak.authorization component of Keycloak. When a group policy is configured with the extendChildren option enabled, the authorization engine performs a raw string prefix match on group paths to determine if a user satisfies the policy requirements. Because the check does not account for path delimiters, a user belonging to a sibling group whose path shares a prefix with the target group (for example, /group-sibling vs /group) is incorrectly granted access. An authenticated attacker with low privileges can exploit this by joining a prefix-colliding sibling group to gain elevated permissions, such as fine-grained admin access or authorization-services rights intended only for the target group and its descendants.