PT-2026-24939 · Maven+1 · @Keycloak/Keycloak-Admin-Client+4

Joy Gilbert + 1 · Published 2026-03-12 · Updated 2026-03-13 · CVE-2026-2366

Positive Technologies (AI Summary)

CVSS v3.1

3.1

Low

Base vector

AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Keycloak (affected versions not specified)

Description An authorization bypass issue exists in the Keycloak Admin API. This allows any authenticated user, even those without administrative privileges, to enumerate the organization memberships of other users. This information disclosure occurs if the attacker knows the victim’s unique identifier (UUID) and the Organizations feature is enabled. The API endpoint involved is the Keycloak Admin API. The vulnerable parameter is the victim’s unique identifier (UUID).

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

IDOR

Weakness Enumeration

CWE-639

Related Identifiers

CVE-2026-2366

GHSA-R8JR-WG88-FQ5C

Affected Products

@Keycloak/Keycloak-Admin-Client

Red Hat Build Of Keycloak

Red Hat Build Of Keycloak 26.4

Red Hat Build Of Keycloak 26.4.11

Org.Keycloak:Keycloak-Js-Admin-Client

References · 12

• https://access.redhat.com/errata/RHSA-2026:6478 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2026:6477 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-2366 · Security Note
• https://osv.dev/vulnerability/GHSA-r8jr-wg88-fq5c · Vendor Advisory
• https://github.com/keycloak/keycloak · Note
• https://github.com/keycloak/keycloak/issues/47062 · Note
• https://access.redhat.com/security/cve/CVE-2026-2366 · Note
• https://t.me/CVEtracker/47246 · Telegram Post
• https://twitter.com/cyberbivash/status/2032075138305241496 · Twitter Post
• https://bugzilla.redhat.com/show_bug.cgi?id=2439081 · Note
• https://t.me/cveNotify/155247 · Telegram Post
• https://twitter.com/CVEnew/status/2032410971671765283 · Twitter Post