CVEvulnerability
CVE-2026-0871
4.9 MEDIUM
Official page ↗
- Status
- Analyzed
- Published
- 2026-02-27
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 4.9 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N
- Weaknesses
- CWE-266
Description
A flaw was found in Keycloak. An administrator with `manage-users` permission can bypass the "Only administrators can view" setting for unmanaged attributes, allowing them to modify these attributes. This improper access control can lead to unauthorized changes to user profiles, even when the system is configured to restrict such modifications.
Affected configurations
• redhat build of keycloak (< 26.4.9)
• redhat build of keycloak
• redhat keycloak (< 26.4.0)
Related
Weakness · CWE (1)
- CWE-266 Incorrect Privilege Assignment weakness
References
- https://access.redhat.com/errata/RHSA-2026:2365 Vendor Advisory
- https://access.redhat.com/errata/RHSA-2026:2366 Vendor Advisory
- https://access.redhat.com/security/cve/CVE-2026-0871 Vendor Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2428881 Issue Tracking, Vendor Advisory