4.9
Medium
CVE-2026-0871 A flaw was found in Keycloak
Description
A flaw was found in Keycloak. An administrator with `manage-users` permission can bypass the "Only administrators can view" setting for unmanaged attributes, allowing them to modify these attributes. This improper access control can lead to unauthorized changes to user profiles, even when the system is configured to restrict such modifications.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Red Hat build of Keycloak 26.4 26.4 | earliest → < 26.4-10 | 26.4-10 |
| Red Hat build of Keycloak 26.4.9 | Versions not published | |
| Red Hat JBoss Enterprise Application Platform 8 | Versions not published | |
| Red Hat JBoss Enterprise Application Platform Expansion Pack | Versions not published | |
| Red Hat Single Sign-On 7 | Versions not published |
References
- RHSA-2026:2365 access.redhat.com
- RHSA-2026:2366 access.redhat.com
- access.redhat.com access.redhat.com
- RHBZ#2428881 bugzilla.redhat.com
Timeline
- Published
- Last modified
Other CVEs of Red Hat build of Keycloak 26.4
The 87 CVEs of Red Hat build of Keycloak 26.4 →
CVE-2026-19607
A flaw was found in the first-broker-login flow of the keycloak-services component
5.3
Medium
CVE-2026-17526
Keycloak is an open-source identity and access management solution
7.2
High
CVE-2026-79651
A flaw was found in the theme localization endpoints of the keycloak-services component, which is the core service…
7.5
High
CVE-2026-74909
Keycloak provides a policy enforcer to protect applications by matching incoming web requests against defined security…
8.1
High