CVE-2026-2366

Description

A flaw was found in Keycloak. An authorization bypass vulnerability in the Keycloak Admin API allows any authenticated user, even those without administrative privileges, to enumerate the organization memberships of other users. This information disclosure occurs if the attacker knows the victims unique identifier (UUID) and the Organizations feature is enabled.

Risk Information

Base Score

3.1

MODERATE

Vector

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N

EPSS Score

Exploitation Probability

0.03

Associated Vulnerability

Vulnerability	OS Platform
Vulnerabilities CVE-2026-2366 are affected in Keycloak - keycloak-js-admin-client 26.5.5	Windows
Vulnerabilities CVE-2026-2366 are affected in Keycloak - keycloak-js-admin-client for Linux 26.5.5	Linux

Patch Details

No records found

References

https://nvd.nist.gov/vuln/detail/CVE-2023-1234
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-1234