CVE-2026-0871 PUBLISHED

Org.keycloak/keycloak-services: keycloak: unauthorized modification of unmanaged user attributes by administrators

Assigner: redhat
Reserved: 13.01.2026 Published: 27.02.2026 Updated: 27.02.2026

A flaw was found in Keycloak. An administrator with manage-users permission can bypass the "Only administrators can view" setting for unmanaged attributes, allowing them to modify these attributes. This improper access control can lead to unauthorized changes to user profiles, even when the system is configured to restrict such modifications.

Metrics

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N
CVSS Score: 4.9

Product Status

Vendor Red Hat
Product Red Hat build of Keycloak 26.4
Versions Default: affected
  • unaffected from 26.4.9-1 to * (excl.)
Vendor Red Hat
Product Red Hat build of Keycloak 26.4
Versions Default: affected
  • unaffected from 26.4-11 to * (excl.)
Vendor Red Hat
Product Red Hat build of Keycloak 26.4
Versions Default: affected
  • unaffected from 26.4-10 to * (excl.)
Vendor Red Hat
Product Red Hat build of Keycloak 26.4.9
Versions Default: unaffected
Vendor Red Hat
Product Red Hat JBoss Enterprise Application Platform 8
Versions Default: affected
Vendor Red Hat
Product Red Hat JBoss Enterprise Application Platform Expansion Pack
Versions Default: affected
Vendor Red Hat
Product Red Hat Single Sign-On 7
Versions Default: affected

Workarounds

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.

References

Problem Types

  • Incorrect Privilege Assignment CWE