CVE-2026-2366

LOW EPSS 19.2%

Published Mar 12, 20263mo ago · Modified Apr 2, 20263mo ago

3.1 CVSS 3.1

Low

Published Mar 12, 2026 3mo ago

Last Modified Apr 2, 2026 3mo ago

Description

A flaw was found in Keycloak. An authorization bypass vulnerability in the Keycloak Admin API allows any authenticated user, even those without administrative privileges, to enumerate the organization memberships of other users. This information disclosure occurs if the attacker knows the victim's unique identifier (UUID) and the Organizations feature is enabled.

CVSS Details

Base Score

3.1

Exploitability

1.6

Impact

1.4

Vector string

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N

Attack Vector Network

Attack Complexity High

Privileges Required Low

User Interaction None

Scope Unchanged

Confidentiality Low

Integrity None

Availability None

Threat Intelligence

EPSS Exploit Probability

19.2% percentile

Exploit & Patch Status

No Known Exploit

No Patch Available

Weaknesses 1

CWE-639

References 4

access.redhat.com https://access.redhat.com/errata/RHSA-2026:6477
access.redhat.com https://access.redhat.com/errata/RHSA-2026:6478
access.redhat.com https://access.redhat.com/security/cve/CVE-2026-2366
bugzilla.redhat.com https://bugzilla.redhat.com/show_bug.cgi?id=2439081

Remediation

No remediation data recorded yet

Check vendor advisories and the NVD entry for patch availability.