CVE-2026-9088 Keycloak: keycloak: information disclosure due to user profile permission bypass
An administrator with delegated access can bypass user profile permissions to view restricted user attributes via the group members endpoint.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-9088?
CVE-2026-9088 is a low-severity missing authorization vulnerability in Red Hat build of Keycloak 26.4, published on 5 Jun 2026. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
A flaw was found in org.keycloak.services. An administrator with delegated access to read group memberships and users can bypass user profile permissions by accessing the group members endpoint. This allows the administrator to view user attributes that are explicitly configured to be denied, leading to information disclosure.
Weakness: CWE-1220
Which versions are affected by CVE-2026-9088?
2 open source packages ship an affected version, including org.keycloak:keycloak-services.
| Package | Affected | Fixed in |
|---|---|---|
org.keycloak:keycloak-services Maven | All versions | 26.7.0 |
org.keycloak:keycloak-services Maven | All versions | 26.7.0 |
How do I fix CVE-2026-9088?
Upgrade org.keycloak:keycloak-services to 26.7.0 or later.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-9088 being exploited?
There is no known exploitation of CVE-2026-9088 in the wild and no public exploit code.
Sources
Also known as ECHO-c65c-7556-f94f, GHSA-6g26-7cx5-mrrg, MINI-m7c8-gvf8-v8fp, MINI-qcx6-29w5-w5jg.