What is the CVSS score of CVE-2026-2366?

CVE-2026-2366 has a CVSS 3.1 base score of 3.1 (Low). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.0%.

Which versions of Keycloak. An are affected by CVE-2026-2366?

CVE-2026-2366 is a low-severity vulnerability in A flaw (CVSS 3.1). The limited severity suggests constrained impact, typically requiring specific conditions or local access for exploitation.

How to fix or mitigate CVE-2026-2366?

During next maintenance window: Apply vendor patches when convenient. Monitor vendor channels for updates.

Keycloak. An CVE-2026-2366

LOW

Authorization Bypass Through User-Controlled Key (CWE-639)

2026-03-12 secalert@redhat.com

GHSA-r8jr-wg88-fq5c

Information Disclosure Authentication Bypass

3.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

3.1 LOW

AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N

Attack Vector

Network

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

CVE Published

Mar 12, 2026 - 11:15 nvd

LOW 3.1

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

5 npm packages depend on @keycloak/keycloak-admin-client (3 direct, 2 indirect)

Ecosystem-wide dependent count for version 26.5.5.

DescriptionCVE.org

A flaw was found in Keycloak. An authorization bypass vulnerability in the Keycloak Admin API allows any authenticated user, even those without administrative privileges, to enumerate the organization memberships of other users. This information disclosure occurs if the attacker knows the victim's unique identifier (UUID) and the Organizations feature is enabled.