CVE-2026-7500

Published: Apr 30, 2026Modified: Jun 26, 2026

5.4

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Exploitability: 2.8 / Impact: 2.5

Source: secalert@redhat.com (Secondary)

Description

When Keycloak is started with `--features-disabled=account,account-api`, the Account REST API is only partially disabled. Five endpoints under the versioned path `/account/v1alpha1` remain fully functional — including both read and write operations — because they lack the `checkAccountApiEnabled()` gate that correctly blocks four other endpoints in the same REST service class. The user needs to have permissions to use the API.

Affected (1)

Products: Redhat: Build Of Keycloak

1 product

Build Of Keycloak

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Redhat Build Of Keycloak	All versions

Related CWEs

Direct Request ('Forced Browsing')

The web application does not adequately enforce appropriate authorization on all restricted URLs, scripts, or files.

References (6)

https://access.redhat.com/errata/RHSA-2026:25097

Source: secalert@redhat.com

https://access.redhat.com/errata/RHSA-2026:25098

Source: secalert@redhat.com

https://access.redhat.com/errata/RHSA-2026:30049

Source: secalert@redhat.com

https://access.redhat.com/errata/RHSA-2026:30050

Source: secalert@redhat.com

https://access.redhat.com/security/cve/CVE-2026-7500

Source: secalert@redhat.com

Vendor Advisory

https://bugzilla.redhat.com/show_bug.cgi?id=2464126

Source: secalert@redhat.com

Issue Tracking

Timeline

No history available yet.