GHSA-r8jr-wg88-fq5c

Source

https://github.com/advisories/GHSA-r8jr-wg88-fq5c

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/03/GHSA-r8jr-wg88-fq5c/GHSA-r8jr-wg88-fq5c.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-r8jr-wg88-fq5c

Aliases

BIT-keycloak-2026-2366
CVE-2026-2366

Published

2026-03-12T12:30:29Z

Modified

2026-08-26T01:11:27Z

Severity

3.1 (Low) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N CVSS Calculator

Summary

Keycloak vulnerable to authorization bypass via the Admin API

Details

A flaw was found in Keycloak. An authorization bypass vulnerability in the Keycloak Admin API allows any authenticated user, even those without administrative privileges, to enumerate the organization memberships of other users. This information disclosure occurs if the attacker knows the victim's unique identifier (UUID) and the Organizations feature is enabled.

Database specific

{
    "cwe_ids":  [
        "CWE-639"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2026-03-12T17:38:28Z",
    "nvd_published_at":  "2026-03-12T11:15:55Z",
    "severity":  "LOW"
}

References

Affected packages

npm / @keycloak/keycloak-admin-client

Package

Name: @keycloak/keycloak-admin-client; View open source insights on deps.dev
Purl: pkg:npm/%40keycloak/keycloak-admin-client

Affected ranges

Type: SEMVER
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Last Affected

26.5.5

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/03/GHSA-r8jr-wg88-fq5c/GHSA-r8jr-wg88-fq5c.json"

Maven / org.keycloak:keycloak-js-admin-client

Package

Name: org.keycloak:keycloak-js-admin-client; View open source insights on deps.dev
Purl: pkg:maven/org.keycloak/keycloak-js-admin-client

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Last Affected

26.5.5

Affected versions

26.*

26.3.0

26.3.1

26.3.2

26.3.3

26.3.4

26.3.5

26.4.0

26.4.1

26.4.2

26.4.3

26.4.4

26.4.5

26.4.6

26.4.7

26.5.0

26.5.1

26.5.2

26.5.3

26.5.4

26.5.5

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/03/GHSA-r8jr-wg88-fq5c/GHSA-r8jr-wg88-fq5c.json"