Keycloak Admin API Flaw Allows Unauthorized Group Access

• •CVE-2026-97311 allows unauthorized access to group information in Keycloak.
• •Delegated administrators can bypass security restrictions due to improper permission checks.
• •Immediate patching or access restrictions are recommended to mitigate risks.

A vulnerability identified as CVE-2026-97311 in the Admin REST API of Keycloak permits delegated administrators with basic privileges to access detailed information about all groups associated with a specific role. This flaw arises from improper checks for group visibility permissions, allowing unauthorized visibility into groups that should be restricted. The CVSS score assigned to this vulnerability is 4.3, categorizing it as medium severity. Currently, there is no evidence of public proof-of-concept exploitation or active exploitation in the wild. Organizations using affected versions of Keycloak are urged to apply the patch immediately or restrict API access to trusted administrators. The vulnerability was reported to Red Hat on September 22, 2026, and made public on the same day. Administrators are advised to audit API access logs to identify any unauthorized exposure of group information.