Back cve.threatint.com

Keycloak-services: keycloak-services: admin rest api role-groups endpoint dis... CVE: New / 5h This allows a delegated administrator with basic search privileges to view detailed information about all groups assigned to a role, bypassing intended security restrictions that should limit their view to specific groups. The endpoints used to retrieve groups associated with a specific role do not properly check for individual group visibility permissions.

cve.threatint.com • September 24, 2026

A flaw was found in the Admin REST API of Keycloak, an identity and access management solution. The endpoints used to retrieve groups associated with a specific role do not properly check for individual group visibility permissions. This allows a delegated administrator with basic privileges to view detailed information all groups assigned to a role, bypassing intended security restrictions that should limit their view to specific groups.

PUBLISHED Reserved 2026-09-24 | Published 2026-09-24 | Updated 2026-09-24 | Assigner redhat

MEDIUM: 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N Problem types Missing Authorization Product status Default status affected Default status affected Default status unaffected Timeline 2026-09-22: Reported to Red Hat. 2026-09-22: Made public. Credits Red Hat would like to thank Nomit Vyas for reporting this issue. References access.redhat.com/security/cve/CVE-2026-97311 vdb-entry cve.org (CVE-2026-97311) nvd.nist.gov (CVE-2026-97311) Download JSON

Missing Authorization

Red Hat would like to thank Nomit Vyas for reporting this issue.

access.redhat.com/security/cve/CVE-2026-97311 vdb-entry

cve.org (CVE-2026-97311)

nvd.nist.gov (CVE-2026-97311)

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Keycloak Admin API Flaw Allows Unauthorized Group Access A vulnerability identified as CVE-2026-97311 in the Admin REST API of Keycloak permits delegated administrators with basic privileges to access detailed information about all groups associated with a specific role. This flaw arises from improper checks for group visibility permissions, allowing unauthorized visibility into groups that should be restricted. The CVSS score assigned to this vulnerability is 4.3, categorizing it as medium severity. Currently, there is no evidence of public proof-of-concept exploitation or active exploitation in the wild. Organizations using affected versions of Keycloak are urged to apply the patch immediately or restrict API access to trusted administrators. The vulnerability was reported to Red Hat on September 22, 2026, and made public on the same day. Administrators are advised to audit API access logs to identify any unauthorized exposure of group information. 1 sources 46

Extracted Entities

The full story

Extracted Entities

CVEs (1)

CWE Weaknesses (1)

Domains (3)

Platforms (1)