When Red Hat build of Keycloak 26.4 is started with the features `account` and `account-api` disabled, the Account REST API is only partially disabled. Five endpoints under the versioned path `/account/v1alpha1` remain fully functional because they lack the `checkAccountApiEnabled()` gate that blocks other endpoints. Although users need appropriate permissions to use these endpoints, the absence of this check constitutes an improper access control vulnerability. Red Hat has acknowledged this issue in their security advisories and released updated Keycloak 26.6.3 images that include security fixes for this and other vulnerabilities. However, no explicit fix for CVE-2026-7500 alone is detailed, and the advisories do not list a specific patch for this CVE.

The vulnerability allows users with some level of permission to access and perform read and write operations on certain Account REST API endpoints that should have been disabled. This improper access control could lead to unauthorized account operations, potentially exposing or modifying account-related data. The CVSS 3.1 base score is 5.4 (medium), reflecting network attack vector, low attack complexity, required privileges, no user interaction, and limited confidentiality and integrity impact without availability impact.

Red Hat has released updated Red Hat build of Keycloak 26.6.3 images that address this and other vulnerabilities. Users should upgrade to these newer versions to mitigate the issue. Before applying updates, back up existing installations including configurations and databases. Since no separate patch specifically for CVE-2026-7500 is listed, upgrading to the latest fixed version is the recommended remediation. Monitor Red Hat advisories for any further updates or patches. No vendor advisory states that no action is required or that the issue is already mitigated without upgrade.