The vulnerability CVE-2026-9088 in Red Hat build of Keycloak 26.4 involves insufficient granularity of access control in the org.keycloak.services component. An administrator with delegated read access to group memberships and users can bypass user profile permissions by accessing the group members endpoint, allowing disclosure of user attributes that should be denied. The CVSS 3.1 base score is 2.7 (low), reflecting network attack vector, low complexity, high privileges required, no user interaction, unchanged scope, and limited confidentiality impact. The vendor advisory references updated Keycloak 26.6.3 images that include security fixes for this and other vulnerabilities, but does not explicitly confirm a patch specifically for CVE-2026-9088. No known exploits in the wild are reported.

An administrator with delegated read access can bypass user profile permission restrictions to view user attributes that are explicitly denied, causing information disclosure. There is no impact on integrity or availability. The confidentiality impact is limited to unauthorized viewing of certain user attributes. Exploitation requires high privileges (administrator with delegated access).

Red Hat has released updated Keycloak 26.6.3 images that include security fixes addressing CVE-2026-9088 among other vulnerabilities. It is recommended to update to these newer versions to remediate the issue. Before applying updates, back up existing installations including applications, configuration files, and databases. Patch status is not explicitly confirmed for this CVE alone, but the vendor advisory indicates the issue is addressed in the 26.6.3 release. No other specific mitigations or workarounds are stated.