Every CVE Search/ Get API key

CVE-2026-9791

Keycloak-rhel9: organization data leak after feature disabled in keycloak

4.3 MediumFix available

A flaw was found in Keycloak. An authenticated user with existing organization membership can exploit this flaw by accessing user-facing APIs, such as the account API or by requesting an OpenID Connect (OIDC) token with the 'organization' scope. This allows organization metadata to be disclosed in tokens, even after an administrator has explicitly disabled the Organizations feature, potentially leading to incorrect authorization decisions by resource servers.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
Low
User interaction
None

What an attacker can affect

Confidentiality
Low
Integrity
None
Availability
None

Exploit likelihood

0.21%Up 0.2 points since May 28, 2026
90%50%10%1%

What each source reports

CVE List Score used 4.3

Keycloak-rhel9: organization data leak after feature disabled in keycloak

A flaw was found in Keycloak. An authenticated user with existing organization membership can exploit this flaw by accessing user-facing APIs, such as the account API or by requesting an OpenID Connect (OIDC) token with the 'organization' scope. This allows organization metadata to be disclosed in tokens, even after an administrator has explicitly disabled the Organizations feature, potentially leading to incorrect authorization decisions by resource servers.

Record
CVE-2026-9791
CVSS 3.1
4.3 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Weakness
CWE-863
Updated
2026-11-02
EUVDEUVD-2026-32701 4.3

A flaw was found in Keycloak. An authenticated user with existing organization membership can exploit this flaw by accessing user-facing APIs, such as the account API or by requesting an OpenID Connect (OIDC) token with the 'organization' scope. This allows organization metadata to be disclosed in tokens, even after an administrator has explicitly disabled the Organizations feature, potentially leading to incorrect authorization decisions by resource servers.

Record
EUVD-2026-32701
CVSS 3.1
4.3 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Updated
2026-11-02
GitHub AdvisoriesGHSA-4q93-v92x-p89f 4.3

Keycloak Vulnerable to Incorrect Authorization

A flaw was found in Keycloak. An authenticated user with existing organization membership can exploit this flaw by accessing user-facing APIs, such as the account API or by requesting an OpenID Connect (OIDC) token with the 'organization' scope. This allows organization metadata to be disclosed in tokens, even after an administrator has explicitly disabled the Organizations feature, potentially leading to incorrect authorization decisions by resource servers.

Record
GHSA-4q93-v92x-p89f
CVSS 3.1
4.3 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Weakness
CWE-863
Updated
2026-11-02
NVD 4.3

A flaw was found in Keycloak. An authenticated user with existing organization membership can exploit this flaw by accessing user-facing APIs, such as the account API or by requesting an OpenID Connect (OIDC) token with the 'organization' scope. This allows organization metadata to be disclosed in tokens, even after an administrator has explicitly disabled the Organizations feature, potentially leading to incorrect authorization decisions by resource servers.

Record
CVE-2026-9791
CVSS 3.1
4.3 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Weakness
CWE-863
Updated
2026-11-02
OSVGHSA-4q93-v92x-p89f 4.3

Keycloak Vulnerable to Incorrect Authorization

A flaw was found in Keycloak. An authenticated user with existing organization membership can exploit this flaw by accessing user-facing APIs, such as the account API or by requesting an OpenID Connect (OIDC) token with the 'organization' scope. This allows organization metadata to be disclosed in tokens, even after an administrator has explicitly disabled the Organizations feature, potentially leading to incorrect authorization decisions by resource servers.

Record
GHSA-4q93-v92x-p89f
CVSS 3.1
4.3 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Weakness
CWE-863
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
org.keycloak:keycloak-server-spi-private
Maven
 26.5.0 up to 26.6.3
26.6.3
org.keycloak:keycloak-services
Maven
 26.5.0 up to 26.6.3
26.6.3
org.keycloak:keycloak-server-spi-private
Maven
 through 26.4.7 None known
org.keycloak:keycloak-services
Maven
 through 26.4.7 None known
org.keycloak:keycloak-server-spi-private
Maven
 26.5.0 up to 26.6.3, plus listed versions
26.5.126.5.226.5.326.5.426.5.5
Show 5 moreShow less
26.5.626.5.726.6.026.6.126.6.2
26.6.3
org.keycloak:keycloak-services
Maven
 26.5.0 up to 26.6.3, plus listed versions
26.5.126.5.226.5.326.5.426.5.5
Show 5 moreShow less
26.5.626.5.726.6.026.6.126.6.2
26.6.3
org.keycloak:keycloak-server-spi-private
Maven
 through 26.4.7, plus listed versions
10.0.010.0.110.0.211.0.011.0.1
Show 45 moreShow less
11.0.211.0.312.0.012.0.112.0.212.0.312.0.413.0.013.0.114.0.015.0.015.0.115.0.215.1.015.1.116.0.016.1.016.1.117.0.017.0.118.0.018.0.118.0.219.0.019.0.119.0.219.0.32.4.0.CR12.4.0.Final2.5.0.CR12.5.0.Final2.5.1.Final2.5.4.Final2.5.5.Final20.0.020.0.120.0.220.0.320.0.420.0.521.0.021.0.121.0.221.1.021.1.1
 None known
org.keycloak:keycloak-services
Maven
 through 26.4.7, plus listed versions
1.0-alpha-11.0-alpha-1-120620131.0-alpha-21.0-alpha-31.0-alpha-4
Show 45 moreShow less
1.0-beta-11.0-beta-1-201505211.0-beta-1-201505231.0-beta-21.0-beta-31.0-beta-41.0-final1.0-rc-11.0-rc-21.0.1.Final1.0.2.Final1.0.3.Final1.0.4.Final1.0.5.Final1.1.0.Beta11.1.0.Beta21.1.0.Final1.1.1.Final1.2.0.Beta11.2.0.CR11.2.0.Final1.3.0.Final1.3.1.Final1.4.0.Final1.5.0-Final1.5.0.Final1.5.1.Final1.6.0.Final1.6.1.Final1.7.0.CR11.7.0.Final1.8.0.Alpha11.8.0.CR11.8.0.CR21.8.0.CR31.8.0.Final1.8.1.Final1.9.0.CR11.9.0.Final1.9.1.Final1.9.2.Final1.9.3.Final1.9.4.Final1.9.5.Final1.9.7.Final
 None known

History

History
RecordedChangedSources
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-9791 is a medium vulnerability (CVSS 4.3) in Red Hat Build Of Keycloak 26.4, published May 28, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.21%, the 11th percentile. Fixed in org.keycloak:keycloak-server-spi-private 26.6.3.

References

Show 10 moreShow less
This page doesn't list everything

Left out here: 270 versions. The JSON record has them.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open