CVE-2026-16072 describes a security flaw in Red Hat Build of Keycloak's organization management component. A delegated administrator who can manage organizations can exploit this flaw by creating an invitation for a non-existent email address and then obtaining the secret registration link through the API. Using this link, the administrator can create new user accounts and add them to the organization without requiring user management permissions or access to the invited email account. This vulnerability allows bypassing of intended security restrictions to add unauthorized members to an organization. The CVSS 3.1 base score is 4.9 (medium severity), reflecting the network attack vector, low attack complexity, high privileges required, no user interaction, unchanged scope, no confidentiality impact, high integrity impact, and no availability impact. No patch or official remediation level is currently indicated in the vendor advisory. The vendor advisory URL is provided for updates.

The vulnerability allows a delegated administrator with organization management permissions to bypass user management restrictions and add unauthorized user accounts to an organization. This can lead to unauthorized access and potential misuse of organizational resources. There is no impact on confidentiality or availability, but the integrity of the organization membership is compromised.

Patch status is not yet confirmed — check the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-16072 for current remediation guidance. Until a fix is available, organizations should review delegated administrator permissions and restrict invitation capabilities to trusted users only. Monitor for unusual account creation activity related to organization invitations.