CVE-2026-9088
Keycloak Group Members Endpoint Information Disclosure
Publication date: 2026-06-05
Last updated on: 2026-06-05
Assigner: Red Hat, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| keycloak | keycloak | * |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-1220 | The product implements access controls via a policy or other feature with the intention to disable or restrict accesses (reads and/or writes) to assets in a system from untrusted agents. However, implemented access controls lack required granularity, which renders the control policy too broad because it allows accesses from unauthorized agents to the security-sensitive assets. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in Keycloak where an administrator who has delegated access to read group memberships and users can bypass user profile permissions by accessing the group members endpoint.
As a result, the administrator can view user attributes that are explicitly configured to be denied, leading to unauthorized information disclosure.
How can this vulnerability impact me? :
The vulnerability can lead to information disclosure by allowing an administrator with certain delegated permissions to access user attributes that should be restricted.
This means sensitive user data that was intended to be hidden can be viewed, potentially compromising user privacy and security.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
This vulnerability allows an administrator with delegated access to bypass user profile permissions and view user attributes that are explicitly configured to be denied. Such unauthorized disclosure of user information can lead to non-compliance with data protection regulations like GDPR and HIPAA, which require strict controls on access to personal and sensitive data.
By exposing restricted user attributes, the flaw increases the risk of information disclosure, potentially violating privacy and security requirements mandated by these standards.