CVE-2026-16108

Katalog CVE

CVSS 6.5 · Medium EPSS 0,37%

Kerentanan Insufficient Granularity of Access Control pada redhat build of keycloak. Skor CVSS 3.1 6.5 (Medium) menurut NVD.

Deskripsi (NVD)

A flaw was found in the default-groups REST endpoint and realm representation of Keycloak. This component is responsible for managing groups that are automatically assigned to new users within a realm. The issue allows a delegated administrator with realm-viewing permissions to see the names and identifiers of hidden default groups, even if they lack the specific permissions to view those groups. This can lead to the exposure of sensitive organizational structures or internal group names.

Rincian

Terbit di NVD

17 Juli 2026

Terakhir diubah

16 September 2026

Status NVD

Modified

CVSS 3.1

6.5 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-1220: Insufficient Granularity of Access Control
CWE-200: Exposure of Sensitive Information to an Unauthorized Actor

EPSS (30 hari)

0,37% peluang dieksploitasi; lebih tinggi dari 29,0% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://access.redhat.com/security/cve/CVE-2026-16108 advisory vendor
• https://bugzilla.redhat.com/show_bug.cgi?id=2501740 issue tracking · advisory vendor
• https://access.redhat.com/errata/RHSA-2026:68277
• https://access.redhat.com/errata/RHSA-2026:68278