What is the CVSS score of CVE-2026-2366?

CVE-2026-2366 has a CVSS 3.1 base score of 3.1 (Low). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.0%.

Which versions of Keycloak are affected by CVE-2026-2366?

CVE-2026-2366 is a low-severity vulnerability in A flaw (CVSS 3.1). The limited severity suggests constrained impact, typically requiring specific conditions or local access for exploitation.

How to fix or mitigate CVE-2026-2366?

During next maintenance window: Apply vendor patches when convenient. Monitor vendor channels for updates.

Keycloak CVE-2026-2366

LOW

Authorization Bypass Through User-Controlled Key (CWE-639)

2026-03-12 secalert@redhat.com

GHSA-r8jr-wg88-fq5c

Authentication Bypass Information Disclosure Red Hat Build Of Keycloak

3.1

CVSS 3.1 · Vendor: redhat

Severity by source

Vendor (redhat) PRIMARY

3.1 LOW

AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N

vuln.today AI

3.1 LOW

Network-reachable Admin API (AV:N), but AC:H because target UUID must be known in advance; PR:L as a valid session is required; C:L for limited org membership disclosure only.

3.1 AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N

4.0 AV:N/AC:H/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (redhat).

CVSS VectorVendor: redhat

Attack Vector

Network

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 24, 2026 - 08:19 vuln.today

CVE Published

Mar 12, 2026 - 11:15 nvd

LOW 3.1

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

5 npm packages depend on @keycloak/keycloak-admin-client (3 direct, 2 indirect)

Ecosystem-wide dependent count for version 26.5.5.

DescriptionCVE.org

A flaw was found in Keycloak. An authorization bypass vulnerability in the Keycloak Admin API allows any authenticated user, even those without administrative privileges, to enumerate the organization memberships of other users. This information disclosure occurs if the attacker knows the victim's unique identifier (UUID) and the Organizations feature is enabled.

AnalysisAI

Organization membership enumeration in Keycloak's Admin API exposes a CWE-639 authorization bypass where any authenticated, non-privileged user can query the organization affiliations of any other user, provided they possess the target's UUID and the Organizations feature is active. The CVSS score of 3.1 (Low) reflects the constrained impact - confidentiality-only, limited scope, and high attack complexity - which aligns with the EPSS score of 0.03% (7th percentile), indicating minimal real-world exploitation pressure. Red Hat has released patches under RHSA-2026:6477 and RHSA-2026:6478, and no public exploit code or CISA KEV listing has been identified at the time of this analysis.

Technical ContextAI

Keycloak is a widely-deployed open-source Identity and Access Management (IAM) platform used for SSO, identity brokering, and user federation. Its Admin REST API exposes endpoints for managing realms, users, and organizations. The Organizations feature, when enabled, allows users to be grouped into organizational units within a realm. CWE-639 (Authorization Bypass Through User-Controlled Key) describes a class of flaw where a caller supplies a user-controlled identifier - here, the target user's UUID - and the application fails to verify that the caller is authorized to access data associated with that identifier. In this case, the Admin API endpoint responsible for listing a user's organization memberships does not enforce that the requesting principal holds administrative privileges, allowing any authenticated caller who supplies a valid UUID to retrieve sensitive organizational affiliation data.

RemediationAI

The primary remediation is to apply the vendor-released patches available through Red Hat errata RHSA-2026:6477 (https://access.redhat.com/errata/RHSA-2026:6477) and RHSA-2026:6478 (https://access.redhat.com/errata/RHSA-2026:6478). Exact upstream Keycloak fix versions are not independently confirmed from the available data - consult the Red Hat advisories for the precise patched package versions. If immediate patching is not possible and the Organizations feature is not operationally required, disabling the Keycloak Organizations feature eliminates the attack surface entirely; note that this will remove all organization-related functionality and may affect realm configurations that rely on organizational grouping. If Organizations must remain enabled, restrict Admin API access at the network perimeter to trusted internal hosts only, reducing the pool of potential authenticated callers who could abuse this endpoint. This network-level control does not eliminate the flaw but meaningfully reduces exposure in environments where the Admin API is otherwise accessible to a broad user base.