Threats Tagged 'cve-2026-0871'

A flaw was found in Keycloak. An administrator with `manage-users` permission can bypass the "Only administrators can view" setting for unmanaged attributes, allowing them to modify these attributes. This improper access control can lead to unauthorized changes to user profiles, even when the system is configured to restrict such modifications.

MediumVulnerabilityUnited StatesGermanyUnited Kingdom+7#cve#cve-2026-0871#gcve

Red Hat has released a security advisory for the Red Hat build of Keycloak 26.4.9 images used on OpenShift Container Platform. The update addresses multiple security vulnerabilities including improper invitation token validation, acceptance of disabled identity providers for JWT authorization, incorrect ownership checks, unauthorized modification of user attributes, unauthorized token issuance for disabled users, and exposure of sensitive user attributes via the Admin API. These issues could allow unauthorized access or privilege escalation within Keycloak deployments. The advisory provides updated container images to remediate these vulnerabilities.

Red Hat has issued a security update for its build of Keycloak 26.4.9 addressing multiple vulnerabilities. These include unauthorized organization registration, acceptance of disabled identity providers for JWT authorization, incorrect ownership checks, unauthorized modification of user attributes, unauthorized token issuance for disabled users, and limited administrators retrieving sensitive user attributes via the Admin API. The update is important and aims to fix these security issues.