What’s Vulnerable › Vulnerabilities

CVE-2026-0871: Org.keycloak/keycloak-services: keycloak: unauthorized modification of unmanaged user attributes by administrators

• Severity: medium (CVSS 4.9 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-02-27 · updated 2026-06-17
• Weakness: CWE-266

Description

A flaw was found in Keycloak. An administrator with `manage-users` permission can bypass the "Only administrators can view" setting for unmanaged attributes, allowing them to modify these attributes. This improper access control can lead to unauthorized changes to user profiles, even when the system is configured to restrict such modifications.

Affected products

• Red Hat build of Keycloak 26.4: before 26.4.9 — fixed in 26.4.9
• Keycloak: before 26.4.0 — fixed in 26.4.0

How to fix

Upgrade to a fixed version: Red Hat build of Keycloak 26.4 26.4.9; Keycloak 26.4.0. Check the vendor advisory for mitigations.

References

• https://access.redhat.com/errata/RHSA-2026:2365
• https://access.redhat.com/errata/RHSA-2026:2366
• https://access.redhat.com/security/cve/CVE-2026-0871
• https://bugzilla.redhat.com/show_bug.cgi?id=2428881

Get alerted when CVE-2026-0871 or the next vulnerability affects your stack