Authorization Flaw in Keycloak Identity and Access Management Solution
CVE-2026-94213

4.9MEDIUM

Key Information:

Vendor

Red Hat
Status
Red Hat Build Of Keycloak
Red Hat Single Sign-on 7
Vendor
CVE Published:
21 September 2026

What is CVE-2026-94213?

A flaw in the Authorization Services of Keycloak can lead to unauthorized access to sensitive user information. The vulnerability occurs in the policy evaluation endpoint, which is intended for administrators to assess the applicability of access policies for specific users. Due to insufficient authorization checks, a delegated administrator with restricted privileges can view comprehensive profiles, including email addresses and security roles of any user in the realm. This flaw poses significant risks to user privacy and data security.

References

https://access.redhat.com/security/cve/CVE-2026-94213
vdb-entryx_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2537310
issue-trackingx_refsource_REDHAT

CVSS V3.1

Score:
4.9
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.