TI-2026-00651 Aliases CVE-2026-0871 GHSA-v4jw-m6rm-399h

Org.keycloak/keycloak-services: keycloak: unauthorized modification of unmanaged user attributes by administrators

LOW 22CWE-266Published 2026-02-27 · Updated 2026-03-06

Key facts

Attack vector: Network
Privileges required: High
User interaction: None
Attack complexity: Low
Impact type: Privilege escalation, Security bypass
Confidentiality · integrity · availability: None · High · None
Fix status: Partial Red Hat: 2 fixed, 3 without a fix

Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-266 and CWE-284.

Summary

A flaw was found in Keycloak. An administrator with `manage-users` permission can bypass the "Only administrators can view" setting for unmanaged attributes, allowing them to modify these attributes. This improper access control can lead to unauthorized changes to user profiles, even when the system is configured to restrict such modifications.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00349 28th percentileScored 2026-11-07

Fix Partial org.keycloak:keycloak-server-spi-private (Maven): 26.5.2Red Hat: 2 advisoriesRed Hat: 2 fixed, 3 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Red Hat	Red Hat build of Keycloak 26.4	—	26.4.9-1	Patch available	CNA
Red Hat	Red Hat build of Keycloak 26.4	—	26.4-11	Patch available	CNA
Red Hat	Red Hat build of Keycloak 26.4	—	26.4-10	Patch available	CNA
Red Hat	Red Hat build of Keycloak 26.4.9	—	—	Not affected	CNA
Red Hat	Red Hat JBoss Enterprise Application Platform 8	—	—	No fix listed	CNA
Red Hat	Red Hat JBoss Enterprise Application Platform Expansion Pack	—	—	No fix listed	CNA
Red Hat	Red Hat Single Sign-On 7	—	—	No fix listed	CNA
—	org.keycloak:keycloak-server-spi-private (Maven)	before 26.5.2	26.5.2	Patch available	GHSA-v4jw-m6rm-399h

Red Hat build of Keycloak 26.4 VendorRed Hat Affected — Fixed in 26.4.9-1 Patch available CNA
Red Hat build of Keycloak 26.4 VendorRed Hat Affected — Fixed in 26.4-11 Patch available CNA
Red Hat build of Keycloak 26.4 VendorRed Hat Affected — Fixed in 26.4-10 Patch available CNA
Red Hat build of Keycloak 26.4.9 VendorRed Hat Affected — Fixed in — Not affected CNA
Red Hat JBoss Enterprise Application Platform 8 VendorRed Hat Affected — Fixed in — No fix listed CNA
Red Hat JBoss Enterprise Application Platform Expansion Pack VendorRed Hat Affected — Fixed in — No fix listed CNA
Red Hat Single Sign-On 7 VendorRed Hat Affected — Fixed in — No fix listed CNA
org.keycloak:keycloak-server-spi-private (Maven) Vendor— Affected before 26.5.2 Fixed in 26.5.2 Patch available GHSA-v4jw-m6rm-399h

CPE configurations NVD · 3

CPE	Versions	Role	Vendor
cpe:2.3:a:redhat:build_of_keycloak::::::::	before 26.4.9	Vulnerable	Red Hat
cpe:2.3:a:redhat:build_of_keycloak:-::::text-only:::	not specified by NVD	Vulnerable	Red Hat
cpe:2.3:a:redhat:keycloak::::::::	before 26.4.0	Vulnerable	Red Hat

cpe:2.3:a:redhat:build_of_keycloak:*:*:*:*:*:*:*:* Versions before 26.4.9 Vulnerable ·Red Hat
cpe:2.3:a:redhat:build_of_keycloak:-:*:*:*:text-only:*:*:* Versions not specified by NVD Vulnerable ·Red Hat
cpe:2.3:a:redhat:keycloak:*:*:*:*:*:*:*:* Versions before 26.4.0 Vulnerable ·Red Hat

Remediation

Fix · GHSA-v4jw-m6rm-399h org.keycloak:keycloak-server-spi-private (Maven) Fixed in 26.5.2 Advisory →

Red Hat 2 advisories

RHSA-2026:2366 Released 2026-02-09 · Red Hat rating Important
Red Hat build of Keycloak 26.4.9 Images Security Update
- Red Hat build of Keycloak 26.4 rhbk/keycloak-operator-bundle, rhbk/keycloak-rhel9, rhbk/keycloak-rhel9-operator
RHSA-2026:2365 Released 2026-02-09 · Red Hat rating Important
Red Hat build of Keycloak 26.4.9 Security Update
- Red Hat build of Keycloak 26.4.9

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

Product	Status	Plan or fix
Red Hat JBoss Enterprise Application Platform 8	Affected	No fix yet: Fix deferred
Red Hat JBoss Enterprise Application Platform Expansion Pack	Affected	No fix yet: Fix deferred
Red Hat Single Sign-On 7	Affected	No fix yet: Fix deferred
Red Hat build of Keycloak 26.4	Fixed	RHSA-2026:2366
Red Hat build of Keycloak 26.4.9	Fixed	RHSA-2026:2365

Timeline

2026-10-02 Threatist record created from CVE-2026-0871
2026-10-03 Alias added: GHSA-v4jw-m6rm-399h

References

Advisory 5

Other 3

TI-2026-02223 Keycloak: keycloak: unauthorized authentication via disabled saml identity provider CVSS 3.1HIGH 8.1
TI-2024-01049 Keycloak: path transversal in redirection validation CVSS 3.1HIGH 8.1
TI-2026-13740 Keycloak-services: keycloak-services: saml idp-initiated broker login bypasses link-only restriction CVSS 3.1CRITICAL 9.8
TI-2026-13741 Keycloak-services: keycloak-services: saml broker metadata import disables response signature validation CVSS 3.1CRITICAL 9.1
TI-2026-13106 Keycloak-services: keycloak-services: dcr protocol mapper type-swap policy bypass allows privilege escalation CVSS 3.1HIGH 8.8
TI-2026-02631 Authentication bypass in Red Hat build of Keycloak 26.2 CVSS 3.1HIGH 8.8

See all 110 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences