Riskcovery

CVE-2026-7500

Org.keycloak.keycloak-services: improper access control on keycloak server when the account account api feature is disabled

State
Published
Severity
5.4 Medium
Published
Apr 30, 2026
Updated
Jun 26, 2026
Reserved
Apr 30, 2026

Read the record on cve.org

Description

When Keycloak is started with `--features-disabled=account,account-api`, the Account REST API is only partially disabled. Five endpoints under the versioned path `/account/v1alpha1` remain fully functional — including both read and write operations — because they lack the `checkAccountApiEnabled()` gate that correctly blocks four other endpoints in the same REST service class. The user needs to have permissions to use the API.

Scores

CVSSScoreVectorSource
3.15.4 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:Nredhat

Weaknesses

  • CWE-425 Direct Request ('Forced Browsing')

Affected Products

ProductVersions
Red Hat build of Keycloak 26.4Red Hat
  • 26.4.13-1 and laterNot affected
Red Hat build of Keycloak 26.4Red Hat
  • 26.4-19 and laterNot affected
Red Hat build of Keycloak 26.4Red Hat
  • 26.4-19 and laterNot affected
Red Hat build of Keycloak 26.4.13Red Hat
    Red Hat build of Keycloak 26.6Red Hat
    • 26.6.3-3 and laterNot affected
    Red Hat build of Keycloak 26.6Red Hat
    • 26.6-6 and laterNot affected
    Red Hat build of Keycloak 26.6Red Hat
    • 26.6-6 and laterNot affected
    Red Hat build of Keycloak 26.6.3Red Hat

      References

      Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.