CVE-2026-2366
Keycloak: keycloak: information disclosure via authorization bypass in admin api
- State
- Published
- Severity
- 3.1 Low
- Published
- Mar 12, 2026
- Updated
- Apr 2, 2026
- Reserved
- Feb 11, 2026
Description
A flaw was found in Keycloak. An authorization bypass vulnerability in the Keycloak Admin API allows any authenticated user, even those without administrative privileges, to enumerate the organization memberships of other users. This information disclosure occurs if the attacker knows the victim's unique identifier (UUID) and the Organizations feature is enabled.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 3.1 Low | CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N | redhat |
Weaknesses
- CWE-639 Authorization Bypass Through User-Controlled Key
Affected Products
| Product | Versions |
|---|---|
Red Hat build of Keycloak 26.4Red Hat |
|
Red Hat build of Keycloak 26.4Red Hat |
|
Red Hat build of Keycloak 26.4Red Hat |
|
Red Hat build of Keycloak 26.4.11Red Hat |
References
- RHSA-2026:6477vendor-advisory
- RHSA-2026:6478vendor-advisory
- https://access.redhat.com/security/cve/CVE-2026-2366vdb-entry
- RHBZ#2439081issue-tracking
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.