CVE-2026-2366CWE-639

CVE-2026-2366

Low · published March 12, 2026

CVSS v3.1
3.1
EPSS
0%
Percentile
18.7
In the wild
Unconfirmed
What it is

A flaw was found in Keycloak. An authorization bypass vulnerability in the Keycloak Admin API allows any authenticated user, even those without administrative privileges, to enumerate the organization memberships of other users. This information disclosure occurs if the attacker knows the victim's unique identifier (UUID) and the Organizations feature is enabled.

The record
Technical detail
CVSS v3.1
3.1 · LOW
Vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00273 · 18.7th percentile
Weakness
CWE-639 · Authorization Bypass Through User-Controlled Key
Published
2026-03-12T15:15Z
Affected products (1)
ProductVersionsFixed in
redhat/build_of_keycloak≥ 26.4, < 26.4.1126.4.11
References (4)
https://access.redhat.com/errata/RHSA-2026:6477 · [email protected]https://access.redhat.com/errata/RHSA-2026:6478 · [email protected]https://access.redhat.com/security/cve/CVE-2026-2366 · [email protected]https://bugzilla.redhat.com/show_bug.cgi?id=2439081 · [email protected]
EPSS history
Timeline
  • 12 MAR 10:54Z
    Keycloak: keycloak: information disclosure via authorization bypass in admin api
    cvelistv5