Authorization Bypass in Keycloak Admin API Enables Data Disclosure

Executive Summary

[{'type': 'paragraph', 'content': "CVE-2026-2366 is an information disclosure vulnerability in Keycloak's Admin API caused by an authorization bypass."}, {'type': 'paragraph', 'content': "Specifically, the API endpoint that lists the organizations a user belongs to does not properly check permissions, allowing any authenticated user—even those without administrative privileges—to see the organization memberships of other users if they know the victim's unique identifier (UUID)."}, {'type': 'paragraph', 'content': 'This occurs when the Organizations feature is enabled in Keycloak, and the attacker has a valid access token but lacks the necessary admin roles.'}] [1]

Useful 0 Not Useful 0

Detection Guidance

[{'type': 'paragraph', 'content': 'This vulnerability can be detected by attempting to access the vulnerable Admin API endpoint with a low-privileged authenticated user token and checking if organization membership information of other users is disclosed.'}, {'type': 'list_item', 'content': 'Ensure the Organizations feature is enabled in Keycloak.'}, {'type': 'list_item', 'content': 'Obtain a valid OIDC access token for a low-privileged user.'}, {'type': 'list_item', 'content': 'Perform a GET request to the endpoint `/admin/realms/{realm}/organizations/members/{victim-uuid}/organizations` replacing `{realm}` and `{victim-uuid}` with appropriate values.'}, {'type': 'list_item', 'content': 'If the response is HTTP 200 OK and returns the victim’s organization memberships, the vulnerability is present.'}, {'type': 'paragraph', 'content': 'Example curl command to test the vulnerability:'}, {'type': 'list_item', 'content': 'curl -H "Authorization: Bearer <low-privileged-user-token>" https://<keycloak-server>/admin/realms/<realm>/organizations/members/<victim-uuid>/organizations'}] [1]

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows unauthorized users to obtain information about which organizations other users belong to within Keycloak.

While it does not allow modification or deletion of data, it results in a confidentiality breach by exposing potentially sensitive organizational membership information.

Such information disclosure could be leveraged for further targeted attacks or social engineering.

Useful 0 Not Useful 0

Compliance Impact

I don't know

Useful 0 Not Useful 0

Mitigation Strategies

Currently, no patch is available for this vulnerability.

Immediate mitigation steps include:

• Restrict access to the Keycloak Admin API to only trusted and necessary users.
• Limit or disable the Organizations feature if it is not required.
• Monitor and audit API access logs for suspicious requests to the vulnerable endpoint.
• Ensure that UUIDs of users are not easily guessable or exposed to unauthorized users.

Useful 0 Not Useful 0