Login Request a demo
Medium severity · published Feb 27, 2026
CVE-2026-0871
Org.keycloak/keycloak-services: keycloak: unauthorized modification of unmanaged user attributes by administrators
4.9
CVSS
0.3%
EPSS
No
On KEV
Description
A flaw was found in Keycloak. An administrator with `manage-users` permission can bypass the "Only administrators can view" setting for unmanaged attributes, allowing them to modify these attributes. This improper access control can lead to unauthorized changes to user profiles, even when the system is configured to restrict such modifications.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N
Attack vector
Network
Complexity
Low
Privileges
High
User interaction
None
Confidentiality
None
Integrity
High
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 28% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
RH
Red Hat JBoss Enterprise Application Platform 8 · Red Hat
All versions, or not specified · source: vendor
RH
Red Hat JBoss Enterprise Application Platform Expansion Pack · Red Hat
All versions, or not specified · source: vendor
RH
Red Hat Single Sign-On 7 · Red Hat
All versions, or not specified · source: vendor
RH
Red Hat build of Keycloak 26.4 · Red Hat
All versions, or not specified · source: vendor
BO
Build OF Keycloak · Redhat
before 26.4.9 · source: NVD
KE
Keycloak · Redhat
before 26.4.0 · source: NVD
Affected product
RH
Red Hat build of Keycloak 26.4
Red Hat
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-0871
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-0871
Vendor Advisory
https://access.redhat.com/errata/RHSA-2026:2365
Vendor Advisory
https://access.redhat.com/errata/RHSA-2026:2366
Vendor Advisory
https://access.redhat.com/security/cve/CVE-2026-0871
Issue Tracking
https://bugzilla.redhat.com/show_bug.cgi?id=2428881
More from Red Hat build of Keycloak 26.4
9.8
CVE-2026-16442
Keycloak-services: keycloak-services: saml idp-initiated broker login bypasses link-only restriction
9.1
CVE-2026-18963
Keycloak-services: keycloak-services: unauthenticated account takeover via reset-credentials flow bypass
9.1
CVE-2026-16443
Keycloak-services: keycloak-services: saml broker metadata import disables response signature validation
8.8
CVE-2026-15572
Keycloak-services: keycloak-services: dcr protocol mapper type-swap policy bypass allows privilege escalation
8.8
CVE-2026-9704
Keycloak: keycloak: privilege escalation due to oversized subject_token jwt