Technical impact
This vulnerability in Red Hat’s Keycloak 26.4 allows any authenticated user to retrieve the organization memberships of any other user. By providing the victim’s UUID and if the Organizations feature is enabled, an attacker can enumerate the organizations that the victim belongs to. The flaw is an authorization bypass that compromises confidentiality, exposing internal organizational structure and potentially aiding further attacks.
Affected Systems
The affected product is the Red Hat build of Keycloak 26.4, including revision 26.4.11. Systems running this version are vulnerable.
Risk and Exploitability
The CVSS score of 3.1 indicates low‑moderate severity. An EPSS of less than 1 % suggests a very low probability of exploitation at present, and the vulnerability is not listed in the CISA KEV catalog. The attack requires the attacker to be an authenticated user and to know a target UUID; the primary vector is the Admin API, which can be accessed over the network by any authenticated user. A public fix is available through Red Hat errata RHSA-2026:6477 or RHSA-2026:6478, and systems should apply the update to eliminate the risk.
Github GHSA