CVE-2026-9088
Received Received - Intake
Keycloak Group Members Endpoint Information Disclosure

Publication date: 2026-06-05

Last updated on: 2026-06-05

Assigner: Red Hat, Inc.

Description
A flaw was found in org.keycloak.services. An administrator with delegated access to read group memberships and users can bypass user profile permissions by accessing the group members endpoint. This allows the administrator to view user attributes that are explicitly configured to be denied, leading to information disclosure.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-06-05
Last Modified
2026-06-05
Generated
2026-06-05
AI Q&A
2026-06-05
EPSS Evaluated
N/A
NVD
EUVD
Affected Vendors & Products
Showing 1 associated CPE
Vendor Product Version / Range
keycloak keycloak *
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-1220 The product implements access controls via a policy or other feature with the intention to disable or restrict accesses (reads and/or writes) to assets in a system from untrusted agents. However, implemented access controls lack required granularity, which renders the control policy too broad because it allows accesses from unauthorized agents to the security-sensitive assets.
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?

This vulnerability exists in Keycloak where an administrator who has delegated access to read group memberships and users can bypass user profile permissions by accessing the group members endpoint.

As a result, the administrator can view user attributes that are explicitly configured to be denied, leading to unauthorized information disclosure.


How can this vulnerability impact me? :

The vulnerability can lead to information disclosure by allowing an administrator with certain delegated permissions to access user attributes that should be restricted.

This means sensitive user data that was intended to be hidden can be viewed, potentially compromising user privacy and security.


How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:

This vulnerability allows an administrator with delegated access to bypass user profile permissions and view user attributes that are explicitly configured to be denied. Such unauthorized disclosure of user information can lead to non-compliance with data protection regulations like GDPR and HIPAA, which require strict controls on access to personal and sensitive data.

By exposing restricted user attributes, the flaw increases the risk of information disclosure, potentially violating privacy and security requirements mandated by these standards.


Ask Our AI Assistant
Need more information? Ask your question to get an AI reply (Powered by our expertise)
0/70
EPSS Chart