![CVE-2026-97311: Keycloak-services: keycloak-services: admin rest api role-groups endpoint discloses groups without authorization [MEDIUM] CVSS 4.3 Exploit Intelligence - Recent CVEs / 3h A flaw was found in the Admin REST API of Keycloak, an identity and access management solution. The endpoints used to retrieve groups associated with a specific role do not properly check for individual group visibility permissions. This allows a delegated administrator with basic search privileges to view detai](https://exploit-intel.com/og.png)
Back exploit-intel.com CVE-2026-97311: Keycloak-services: keycloak-services: admin rest api role-groups endpoint discloses groups without authorization [MEDIUM] CVSS 4.3 Exploit Intelligence - Recent CVEs / 3h A flaw was found in the Admin REST API of Keycloak, an identity and access management solution. The endpoints used to retrieve groups associated with a specific role do not properly check for individual group visibility permissions. This allows a delegated administrator with basic search privileges to view detai
Keycloak-services: keycloak-services: admin rest api role-groups endpoint discloses groups without authorization
CVE-2026-97311 has a selected CVSS score of 4.3 (medium).
A flaw was found in the Admin REST API of Keycloak, an identity and access management solution. The endpoints used to retrieve groups associated with a specific role do not properly check for individual group visibility permissions. This allows a delegated administrator with basic privileges to view detailed information all groups assigned to a role, bypassing intended security restrictions that should limit their view to specific groups.
CISA Coordinator · SSVC 2.0.3 · Evaluated Sep 24, 2026 · Source: CVE List
Affected products and versions
Red Hat Build of Keycloak
Default status: affected
Red Hat Build of Keycloak
Default status: affected
Red Hat Single Sign-On 7
Default status: unaffected
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
