Flaw in Admin REST API of Keycloak Allows Unauthorized Group Information Access
CVE-2026-97311

4.3MEDIUM

Key Information:

Vendor

Red Hat
Status
Red Hat Build Of Keycloak
Red Hat Single Sign-on 7
Vendor
CVE Published:
24 September 2026

What is CVE-2026-97311?

A vulnerability has been identified in the Admin REST API of Keycloak that compromises individual group visibility permissions. The issue arises when endpoints intended to retrieve groups assigned to specific roles fail to enforce proper visibility restrictions. As a result, a delegated administrator with basic search privileges may gain access to sensitive information about all groups linked to a role, thereby bypassing intended security measures. This flaw poses a significant risk to organizations using Keycloak for identity and access management, highlighting the importance of robust API security and access control mechanisms.

References

https://access.redhat.com/security/cve/CVE-2026-97311
vdb-entryx_refsource_REDHAT

CVSS V3.1

Score:
4.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Red Hat would like to thank Nomit Vyas for reporting this issue.
.