https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-04T06:12:12.965400+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/bit-keycloak-2026-0871 BIT-keycloak-2026-0871 — Org.keycloak/keycloak-services: keycloak: unauthorized modification of unmanaged user attributes by administrators 2026-10-04T06:12:12.971446+00:00

Affected: Bitnami: keycloak

A flaw was found in Keycloak. An administrator with `manage-users` permission can bypass the "Only administrators can view" setting for unmanaged attributes, allowing them to modify these attributes. This improper access control can lead to unauthorized changes to user profiles, even when the system is configured to restrict such modifications.

 https://cve.radiocsirt.org/vuln/euvd-2026-274859 EUVD-2026-274859 2026-10-04T06:12:12.971499+00:00 EUVD-2026-274859 https://cve.radiocsirt.org/vuln/fkie_cve-2026-0871 fkie_cve-2026-0871 2026-10-04T06:12:12.971516+00:00

A flaw was found in Keycloak. An administrator with `manage-users` permission can bypass the "Only administrators can view" setting for unmanaged attributes, allowing them to modify these attributes. This improper access control can lead to unauthorized changes to user profiles, even when the system is configured to restrict such modifications.

 https://cve.radiocsirt.org/vuln/ghsa-v4jw-m6rm-399h GHSA-v4jw-m6rm-399h — Keycloak Server Private SPI: Improper Access Control Allows Administrators to Bypass Attribute Visibility Restrictions… 2026-10-04T06:12:12.971539+00:00

Affected: Maven: org.keycloak:keycloak-server-spi-private

A flaw was found in Keycloak. An administrator with `manage-users` permission can bypass the "Only administrators can view" setting for unmanaged attributes, allowing them to modify these attributes. This improper access control can lead to unauthorized changes to user profiles, even when the system is configured to restrict such modifications.

 https://cve.radiocsirt.org/vuln/jvndb-2026-026852 jvndb-2026-026852 2026-10-04T06:12:12.971562+00:00

Multiple vulnerabilities exist in Hitachi Ops Center Common Services. CVE-2025-10939, CVE-2025-11537, CVE-2025-11538, CVE-2025-12110, CVE-2025-13467, CVE-2025-13881, CVE-2025-14082, CVE-2025-14083, CVE-2025-14777, CVE-2025-66560, CVE-2026-0707, CVE-2026-0871, CVE-2026-0976, CVE-2026-1035, CVE-2026-1190, CVE-2026-2092, CVE-2026-2575, CVE-2026-2673, CVE-2026-3009, CVE-2026-3121, CVE-2026-3429, CVE-2026-3872, CVE-2026-3911, CVE-2026-4282, CVE-2026-4325, CVE-2026-4634, CVE-2026-22745, CVE-2026-22748, CVE-2026-25854, CVE-2026-40972, CVE-2026-40975

 https://cve.radiocsirt.org/vuln/rhsa-2026:2365 RHSA-2026:2365 — Red Hat Security Advisory: Red Hat build of Keycloak 26.4.9 Security Update 2026-10-04T06:12:12.971582+00:00

org.keycloak.services.resources.admin: Keycloak: Limited administrator can retrieve sensitive user attributes via Admin API org.keycloak/keycloak-services: Keycloak keycloak-services: Business logic flaw allows unauthorized token issuance for disabled users keycloak: Incorrect ownership checks in /uma-policy/ org.keycloak/keycloak-services: Keycloak: Unauthorized modification of unmanaged user attributes by administrators org.keycloak.protocol.oidc.grants: Disabled identity providers are still accepted for JWT Authorization Grant org.keycloak.services.resources.organizations: Keycloak: Unauthorized organization registration via improper invitation token validation

 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-0072 WID-SEC-W-2026-0072 — Keycloak: Schwachstelle ermöglicht Manipulation von Dateien 2026-10-04T06:12:12.971606+00:00

Ein entfernter, authentisierter Angreifer kann eine Schwachstelle in Keycloak ausnutzen, um Dateien zu manipulieren.