CVEvulnerability
CVE-2026-2366
3.1 LOW
Official page ↗
- Status
- Analyzed
- Published
- 2026-03-12
- Last modified
- 2026-08-18
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 3.1 LOW — CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N
- Weaknesses
- CWE-639
Description
A flaw was found in Keycloak. An authorization bypass vulnerability in the Keycloak Admin API allows any authenticated user, even those without administrative privileges, to enumerate the organization memberships of other users. This information disclosure occurs if the attacker knows the victim's unique identifier (UUID) and the Organizations feature is enabled.
Affected configurations
• redhat build of keycloak (>= 26.4 < 26.4.11)
Related
Weakness · CWE (1)
- CWE-639 Authorization Bypass Through User-Controlled Key weakness
References
- https://access.redhat.com/errata/RHSA-2026:6477 Vendor Advisory
- https://access.redhat.com/errata/RHSA-2026:6478 Vendor Advisory
- https://access.redhat.com/security/cve/CVE-2026-2366 Vendor Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2439081 Exploit, Issue Tracking, Vendor Advisory