CVEvulnerability
CVE-2026-9791
4.3 MEDIUM
Official page ↗
- Status
- Modified
- Published
- 2026-05-28
- Last modified
- 2026-10-26
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 4.3 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
- Weaknesses
- CWE-863
Description
A flaw was found in Keycloak. An authenticated user with existing organization membership can exploit this flaw by accessing user-facing APIs, such as the account API or by requesting an OpenID Connect (OIDC) token with the 'organization' scope. This allows organization metadata to be disclosed in tokens, even after an administrator has explicitly disabled the Organizations feature, potentially leading to incorrect authorization decisions by resource servers.
Affected configurations
• redhat build of keycloak
Related
Weakness · CWE (1)
- CWE-863 Incorrect Authorization weakness
References
- https://access.redhat.com/errata/RHSA-2026:25097 access.redhat.com
- https://access.redhat.com/errata/RHSA-2026:25098 access.redhat.com
- https://access.redhat.com/errata/RHSA-2026:30049 access.redhat.com
- https://access.redhat.com/errata/RHSA-2026:30050 access.redhat.com
- https://access.redhat.com/security/cve/CVE-2026-9791 Mitigation, Vendor Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2482458 Issue Tracking, Vendor Advisory