CVE-2026-9088

Awaiting Analysis Awaiting Analysis - Queue

Keycloak Group Members Endpoint Information Disclosure

Publication date: 2026-06-05

Last updated on: 2026-06-26

Assigner: Red Hat, Inc.

Description

A flaw was found in org.keycloak.services. An administrator with delegated access to read group memberships and users can bypass user profile permissions by accessing the group members endpoint. This allows the administrator to view user attributes that are explicitly configured to be denied, leading to information disclosure.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-06-05

Last Modified

2026-06-26

Generated

2026-07-15

AI Q&A

2026-06-05

EPSS Evaluated

2026-07-14

NVD

CVE-2026-9088

EUVD

EUVD-2026-34790

Affected Vendors & Products

Vendor	Product	Version / Range
keycloak	keycloak	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-1220	The product implements access controls via a policy or other feature with the intention to disable or restrict accesses (reads and/or writes) to assets in a system from untrusted agents. However, implemented access controls lack required granularity, which renders the control policy too broad because it allows accesses from unauthorized agents to the security-sensitive assets.

Attack-Flow Graph

Executive Summary

This vulnerability exists in Keycloak where an administrator who has delegated access to read group memberships and users can bypass user profile permissions by accessing the group members endpoint.

As a result, the administrator can view user attributes that are explicitly configured to be denied, leading to unauthorized information disclosure.

Impact Analysis

The vulnerability can lead to information disclosure by allowing an administrator with certain delegated permissions to access user attributes that should be restricted.

This means sensitive user data that was intended to be hidden can be viewed, potentially compromising user privacy and security.

Compliance Impact

This vulnerability allows an administrator with delegated access to bypass user profile permissions and view user attributes that are explicitly configured to be denied. Such unauthorized disclosure of user information can lead to non-compliance with data protection regulations like GDPR and HIPAA, which require strict controls on access to personal and sensitive data.

By exposing restricted user attributes, the flaw increases the risk of information disclosure, potentially violating privacy and security requirements mandated by these standards.

Hi! I’m here to help you understand CVE-2026-9088. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70