CVE-2026-0871

Published: Feb 27, 2026Modified: Jun 17, 2026

4.9

Vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N

Exploitability: 1.2 / Impact: 3.6

Source: secalert@redhat.com (Secondary)

Description

A flaw was found in Keycloak. An administrator with `manage-users` permission can bypass the "Only administrators can view" setting for unmanaged attributes, allowing them to modify these attributes. This improper access control can lead to unauthorized changes to user profiles, even when the system is configured to restrict such modifications.

Affected (3)

Products: Redhat: Build Of Keycloak, Keycloak

2 products

Build Of Keycloak

Configuration A

3 vulnerable

Vulnerable Software	Affected Versions
Redhat Build Of Keycloak	Before 26.4.9
Redhat Build Of Keycloak	All versions
Redhat Keycloak	Before 26.4.0

Related CWEs

Incorrect Privilege Assignment

A product incorrectly assigns a privilege to a particular actor, creating an unintended sphere of control for that actor.

References (4)

https://access.redhat.com/errata/RHSA-2026:2365

Source: secalert@redhat.com

Vendor Advisory

https://access.redhat.com/errata/RHSA-2026:2366

Source: secalert@redhat.com

Vendor Advisory

https://access.redhat.com/security/cve/CVE-2026-0871

Source: secalert@redhat.com

Vendor Advisory

https://bugzilla.redhat.com/show_bug.cgi?id=2428881

Source: secalert@redhat.com

Issue TrackingVendor Advisory

Timeline

No history available yet.