CVE-2026-9088
LowCVSS 2.7Exploitation Probability (EPSS)
Low risk27th percentile - higher than 27% of all known CVEs
Summary
In org.keycloak.services, an administrator with delegated access to read group memberships and users can bypass user profile permissions by accessing the group members endpoint, allowing them to view user attributes that are explicitly denied.
Risk Assessment
Administrators can access sensitive user attributes, violating privacy policies and potentially leading to data disclosure.
Recommendation
Update Keycloak to a version that fixes this behavior, or restrict delegated permissions.
Original NVD description (English source)
A flaw was found in org.keycloak.services. An administrator with delegated access to read group memberships and users can bypass user profile permissions by accessing the group members endpoint. This allows the administrator to view user attributes that are explicitly configured to be denied, leading to information disclosure.