CVE-2026-2366
CVE-2026-2366 · Keycloak: keycloak: information disclosure via authorization bypass in admin api
This page contains facts from public vulnerability sources. Check the original advisory before updating.
A flaw was found in Keycloak. An authorization bypass vulnerability in the Keycloak Admin API allows any authenticated user, even those without administrative privileges, to enumerate the organization memberships of other users. This information disclosure occurs if the attacker knows the victim's unique identifier (UUID) and the Organizations feature is enabled.
CVSS 3.1 · Low · EPSS 0.3%
- Published
- Updated
Stack: node
Affected products and versions
red hat build of keycloak 26.4
- Versions
- ≥ 26.4.11-1: Not affected (rpm)
No fix published
red hat build of keycloak 26.4
- Versions
- ≥ 26.4-14: Not affected (rpm)
No fix published
red hat build of keycloak 26.4.11
No fix published
@keycloak/keycloak-admin-client npm
- Affected ranges
- SEMVER: ≤ 26.5.5
No fix published
org.keycloak:keycloak-js-admin-client Maven
- Versions
- 26.3.0
- 26.3.1
- 26.3.2
- 26.3.3
- 26.3.4
- 26.3.5
- 26.4.0
- 26.4.1
- 26.4.2
- 26.4.3
- 26.4.4
- 26.4.5
- 26.4.6
- 26.4.7
- 26.5.0
- 26.5.1
- 26.5.2
- 26.5.3
- 26.5.4
- 26.5.5
- Affected ranges
- ECOSYSTEM: ≤ 26.5.5
No fix published