CVE-2026-18201: Missing Authorization in Red Hat Red Hat Build of Keycloak
Keycloak provides a way to manage identity providers and organizations through its administrative API. A flaw was discovered where an administrator with permission to manage identity providers could link a new provider to an organization without having the required permissions to manage that organization. This could allow an unauthorized administrator to influence how users log into specific organizations.
AI Analysis
Technical Summary
CVE-2026-18201 is a vulnerability in Red Hat Build of Keycloak where an administrator authorized to manage identity providers can link a new identity provider to an organization without possessing the necessary permissions to manage that organization. This missing authorization check could allow an unauthorized administrator to affect how users authenticate within certain organizations. The vulnerability has a CVSS 3.1 base score of 5.5, indicating medium severity, with low complexity and no user interaction required. The flaw impacts confidentiality and integrity but not availability.
Potential Impact
An attacker with administrative rights limited to managing identity providers could escalate their influence by linking identity providers to organizations they are not authorized to manage. This could lead to unauthorized modification of authentication flows for users in those organizations, potentially undermining access controls and user authentication integrity.
Mitigation Recommendations
Patch status is not yet confirmed — check the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-18201 for current remediation guidance. Until an official fix is available, restrict administrative permissions carefully to minimize exposure to this vulnerability.
CVE-2026-18201: Missing Authorization in Red Hat Red Hat Build of Keycloak
Description
Keycloak provides a way to manage identity providers and organizations through its administrative API. A flaw was discovered where an administrator with permission to manage identity providers could link a new provider to an organization without having the required permissions to manage that organization. This could allow an unauthorized administrator to influence how users log into specific organizations.
CVSS v3.1
Score 5.5medium
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-18201 is a vulnerability in Red Hat Build of Keycloak where an administrator authorized to manage identity providers can link a new identity provider to an organization without possessing the necessary permissions to manage that organization. This missing authorization check could allow an unauthorized administrator to affect how users authenticate within certain organizations. The vulnerability has a CVSS 3.1 base score of 5.5, indicating medium severity, with low complexity and no user interaction required. The flaw impacts confidentiality and integrity but not availability.
Potential Impact
An attacker with administrative rights limited to managing identity providers could escalate their influence by linking identity providers to organizations they are not authorized to manage. This could lead to unauthorized modification of authentication flows for users in those organizations, potentially undermining access controls and user authentication integrity.
Mitigation Recommendations
Patch status is not yet confirmed — check the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-18201 for current remediation guidance. Until an official fix is available, restrict administrative permissions carefully to minimize exposure to this vulnerability.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- redhat
- Date Reserved
- 2026-07-29T07:42:03.892Z
- Cvss Version
- 3.1
- State
- PUBLISHED
- Remediation Level
- null
- Vendor Advisory Urls
- [{"url":"https://access.redhat.com/security/cve/CVE-2026-18201","vendor":"Red Hat"}]
Threat ID: 6a69c9f29c2644c7f8487e30
Added to database: 07/29/2026, 09:37:54 UTC
Last enriched: 07/29/2026, 10:09:02 UTC
Last updated: 07/29/2026, 21:29:15 UTC
Views: 4
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.