PT-2026-36114 · Red Hat · Red Hat Build Of Keycloak

Published 2026-04-30 · Updated 2026-04-30 · CVE-2026-7500

Mitre

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

When Keycloak is started with --features-disabled=account,account-api, the Account REST API is only partially disabled. Five endpoints under the versioned path /account/v1alpha1 remain fully functional — including both read and write operations — because they lack the checkAccountApiEnabled() gate that correctly blocks four other endpoints in the same REST service class. The user needs to have permissions to use the API.

Fix

Weakness Enumeration

CWE-425

Related Identifiers

CVE-2026-7500

Affected Products

Red Hat Build Of Keycloak

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2026-7500 · Security Note
• https://access.redhat.com/security/cve/CVE-2026-7500 · Note
• https://bugzilla.redhat.com/show_bug.cgi?id=2464126 · Note