CVE-2026-0871

Katalog CVE

CVSS 4.9 · Medium EPSS 0,32%

Kerentanan Incorrect Privilege Assignment pada redhat build of keycloak, redhat keycloak. Skor CVSS 3.1 4.9 (Medium) menurut redhat.com.

Deskripsi (NVD)

A flaw was found in Keycloak. An administrator with `manage-users` permission can bypass the "Only administrators can view" setting for unmanaged attributes, allowing them to modify these attributes. This improper access control can lead to unauthorized changes to user profiles, even when the system is configured to restrict such modifications.

Rincian

Terbit di NVD

27 Februari 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

4.9 (Medium), sumber redhat.com
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-266: Incorrect Privilege Assignment

EPSS (30 hari)

0,32% peluang dieksploitasi; lebih tinggi dari 23,0% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://access.redhat.com/errata/RHSA-2026:2365 advisory vendor
• https://access.redhat.com/errata/RHSA-2026:2366 advisory vendor
• https://access.redhat.com/security/cve/CVE-2026-0871 advisory vendor
• https://bugzilla.redhat.com/show_bug.cgi?id=2428881 issue tracking · advisory vendor