Keycloak group-admin to realm-admin privilege escalation

CVE-2026-9099 is an authorization flaw in Keycloak's Admin REST API. The vulnerability is caused by a missing authorization check in the GroupResource.addChild() endpoint, which allows an authenticated user with limited administrative privileges to reparent arbitrary existing groups without proper permission validation. When Fine-Grained Admin Permissions v2 (FGAPv2) is enabled, an attacker who has management rights over a low-privilege group can move a highly privileged group beneath that managed group in the hierarchy. Because administrative permissions on groups are inherited hierarchically, the attacker can thereby obtain unauthorized control over the targeted privileged group's members, including accounts associated with highly privileged roles such as realm administration.