CVE-2026-16072 describes a security flaw in Red Hat Build of Keycloak's organization management component. Delegated administrators authorized to manage organizations can exploit the vulnerability by generating invitations for non-existent emails and obtaining secret registration links through the API. Using these links, they can create user accounts and add them to organizations without the necessary user management permissions or control over the invited email accounts. This bypasses intended access controls and allows unauthorized membership additions to organizations. The CVSS 3.1 base score is 4.9 (medium severity), reflecting the network attack vector, low attack complexity, high privileges required, no user interaction, unchanged scope, no confidentiality impact, but high integrity impact and no availability impact. No official patch or remediation level is currently provided by Red Hat. The vendor advisory link is available but does not specify a fix or mitigation.

The vulnerability allows delegated administrators with organization management permissions to bypass security boundaries by creating unauthorized user accounts and adding them to organizations without proper user management permissions or access to the invited email accounts. This can lead to unauthorized users gaining membership in organizations, potentially impacting the integrity of organizational membership and access control within Keycloak. There is no impact on confidentiality or availability reported.

Patch status is not yet confirmed — check the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-16072 for current remediation guidance. Until an official fix is available, organizations should review delegated administrator permissions and restrict organization management roles to trusted users only. Monitor for unusual invitation creation or user additions. No vendor-provided temporary or official fix is currently documented.