PT-2026-24939 · Maven+1 · @Keycloak/Keycloak-Admin-Client+4

Joy Gilbert + 1 · Publicado 2026-03-12 · Atualizado 2026-03-13 · CVE-2026-2366

Positive Technologies (AI Summary)

CVSS v3.1

3.1

Baixa

Vetor base

AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Keycloak (affected versions not specified)

Description An authorization bypass issue exists in the Keycloak Admin API. This allows any authenticated user, even those without administrative privileges, to enumerate the organization memberships of other users. This information disclosure occurs if the attacker knows the victim’s unique identifier (UUID) and the Organizations feature is enabled. The API endpoint involved is the Keycloak Admin API. The vulnerable parameter is the victim’s unique identifier (UUID).

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

IDOR

Enumeração de Fraquezas

CWE-639

Identificadores relacionados

CVE-2026-2366

GHSA-R8JR-WG88-FQ5C

Produtos afetados

@Keycloak/Keycloak-Admin-Client

Red Hat Build Of Keycloak

Red Hat Build Of Keycloak 26.4

Red Hat Build Of Keycloak 26.4.11

Org.Keycloak:Keycloak-Js-Admin-Client

Referências · 12

• https://github.com/keycloak/keycloak · Nota
• https://github.com/keycloak/keycloak/issues/47062 · Nota
• https://access.redhat.com/errata/RHSA-2026:6478 · Aviso do Fabricante
• https://osv.dev/vulnerability/GHSA-r8jr-wg88-fq5c · Aviso do Fabricante
• https://twitter.com/cyberbivash/status/2032075138305241496 · Publicação no Twitter
• https://access.redhat.com/errata/RHSA-2026:6477 · Aviso do Fabricante
• https://access.redhat.com/security/cve/CVE-2026-2366 · Nota
• https://bugzilla.redhat.com/show_bug.cgi?id=2439081 · Nota
• https://twitter.com/CVEnew/status/2032410971671765283 · Publicação no Twitter
• https://t.me/cveNotify/155247 · Publicação no Telegram
• https://t.me/CVEtracker/47246 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2026-2366 · Nota de Segurança