This vulnerability in Red Hat Build of Keycloak allows an authenticated user who is a member of an organization to exploit user-facing APIs such as the account API or request an OpenID Connect token with the 'organization' scope. Despite an administrator disabling the Organizations feature, organization metadata can still be disclosed in tokens. This incorrect authorization flaw could cause resource servers to make authorization decisions based on outdated or unintended organization information.

The impact is limited to the disclosure of organization metadata in tokens to authenticated users with existing organization membership. This could lead to incorrect authorization decisions by resource servers relying on this metadata. There is no indication of privilege escalation, denial of service, or data integrity impact. The CVSS score of 4.3 reflects a low to medium confidentiality impact with no integrity or availability impact.

Patch status is not yet confirmed — check the vendor advisory at https://access.redhat.com/security/cve/CVE-2026-9791 for current remediation guidance. No official fix or temporary workaround is currently documented in the provided advisory content. Administrators should monitor the vendor advisory for updates and consider restricting access to affected APIs or scopes if feasible until a fix is available.