Description
A flaw was found in Keycloak. An authorization bypass vulnerability in the Keycloak Admin API allows any authenticated user, even those without administrative privileges, to enumerate the organization memberships of other users. This information disclosure occurs if the attacker knows the victim's unique identifier (UUID) and the Organizations feature is enabled.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Red Hat | Red Hat build of Keycloak 26.4 | — | — |
| Red Hat | Red Hat build of Keycloak 26.4.11 | — | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | org.keycloak:keycloak-js-admin-client | <= 26.5.5 | — | GHSA-r8jr-wg88-fq5c |
| npm | @keycloak/keycloak-admin-client | <= 26.5.5 | — | GHSA-r8jr-wg88-fq5c |
Advisories 1
- WID-SEC-2026-0394 Keycloak: Mehrere Schwachstellen ermöglichen Offenlegung von Informationen BSI CERT-Bund (WID) · Apr 6, 2026
References
- RHSA-2026:6477 vendor-advisory
- RHSA-2026:6478 vendor-advisory
- https://access.redhat.com/security/cve/CVE-2026-2366 vdb-entry
- RHBZ#2439081 issue-tracking