Keycloak vulnerable to authorization bypass via the Admin API
A flaw was found in Keycloak. An authorization bypass vulnerability in the Keycloak Admin API allows any authenticated user, even those without administrative privileges, to enumerate the organization memberships of other users. This information disclosure occurs if the attacker knows the victim's unique identifier (UUID) and the Organizations feature is enabled.
01
beschreibt (1)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2026-2366US | — | — | ||
A flaw was found in Keycloak. An authorization bypass vulnerability in the Keycloak Admin API allows any authenticated user, even those without administrative privileges, to enumer… | ||||
02
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
- https://access.redhat.com/errata/RHSA-2026:6477WEB
- https://access.redhat.com/errata/RHSA-2026:6478WEB
- https://access.redhat.com/security/cve/CVE-2026-2366WEB
- https://bugzilla.redhat.com/show_bug.cgi?id=2439081WEB
- https://github.com/keycloak/keycloakPACKAGE
- https://github.com/keycloak/keycloak/issues/47062WEB
- https://nvd.nist.gov/vuln/detail/CVE-2026-2366ADVISORY
scry
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan