https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 03 Oct 2026 10:54:57 +0000 https://cve.radiocsirt.org/vuln/bit-keycloak-2026-17059 <p><strong>Affected:</strong> Bitnami: keycloak</p> <p>A flaw was found in the role-users endpoint of the keycloak-services library, which is the core component of the Keycloak identity and access management solution. The issue occurs because the system fails to check if an administrator has permission to view individual users when listing members of a role. This allows a restricted administrator to see private information, such as names and email addresses, for users they should not be able to access.</p> <p><strong>Affected:</strong> Bitnami: keycloak</p> <p>A flaw was found in the role-users endpoint of the keycloak-services library, which is the core component of the Keycloak identity and access management solution. The issue occurs because the system fails to check if an administrator has permission to view individual users when listing members of a role. This allows a restricted administrator to see private information, such as names and email addresses, for users they should not be able to access.</p> https://cve.radiocsirt.org/vuln/bit-keycloak-2026-17059 https://cve.radiocsirt.org/vuln/cleanstart-2026-zf70449 <p><strong>Affected:</strong> CleanStart: keycloak</p> <p>Security vulnerability affects the keycloak package. A flaw was found in the role-users endpoint of the keycloak-services library, which is the core component of the Keycloak identity and access management solution.</p> <p><strong>Affected:</strong> CleanStart: keycloak</p> <p>Security vulnerability affects the keycloak package. A flaw was found in the role-users endpoint of the keycloak-services library, which is the core component of the Keycloak identity and access management solution.</p> https://cve.radiocsirt.org/vuln/cleanstart-2026-zf70449 https://cve.radiocsirt.org/vuln/euvd-2026-369911 EUVD-2026-369911 https://cve.radiocsirt.org/vuln/euvd-2026-369911 https://cve.radiocsirt.org/vuln/fkie_cve-2026-17059 <p>A flaw was found in the role-users endpoint of the keycloak-services library, which is the core component of the Keycloak identity and access management solution. The issue occurs because the system fails to check if an administrator has permission to view individual users when listing members of a role. This allows a restricted administrator to see private information, such as names and email addresses, for users they should not be able to access.</p> <p>A flaw was found in the role-users endpoint of the keycloak-services library, which is the core component of the Keycloak identity and access management solution. The issue occurs because the system fails to check if an administrator has permission to view individual users when listing members of a role. This allows a restricted administrator to see private information, such as names and email addresses, for users they should not be able to access.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-17059 https://cve.radiocsirt.org/vuln/ghsa-4w3x-69m8-478c <p>A flaw was found in the role-users endpoint of the keycloak-services library, which is the core component of the Keycloak identity and access management solution. The issue occurs because the system fails to check if an administrator has permission to view individual users when listing members of a role. This allows a restricted administrator to see private information, such as names and email addresses, for users they should not be able to access.</p> <p>A flaw was found in the role-users endpoint of the keycloak-services library, which is the core component of the Keycloak identity and access management solution. The issue occurs because the system fails to check if an administrator has permission to view individual users when listing members of a role. This allows a restricted administrator to see private information, such as names and email addresses, for users they should not be able to access.</p> https://cve.radiocsirt.org/vuln/ghsa-4w3x-69m8-478c https://cve.radiocsirt.org/vuln/rhsa-2026:68277 <p>keycloak-services: keycloak-services: Group hierarchy search discloses hidden parent groups under FGAP v2 keycloak-services: keycloak-services: Organization invitation link exposure allows unauthorized member creation keycloak-services: keycloak-services: Authorization codes can be retargeted to another client session keycloak-services: keycloak-services: Required signed-JWT assertion policy can be bypassed with unsigned assertion headers keycloak-services: keycloak-services: Authenticator config endpoint exposes raw reCAPTCHA secrets to view-only admins keycloak-services: keycloak-services: Missing per-role authorization on RoleContainerResource composite endpoints keycloak-services: keycloak-services: Incorrect authorization in admin role-composite deletion allows delegated admin to remove privileged child roles keycloak-services: keycloak-services: Realm default-group reads disclose hidden groups under FGAP v2 keycloak-services: keycloak-services: Information disclosure via role-users endpoint bypasses per-user view filter keycloak-services: keycloak-services: Privilege escalation via impersonation role allows takeover of realm administrator accounts resteasy-core: RESTeasy SourceProvider remote unauthenticated file read keycloak-services: keycloak-services: Generic identity-provider creation can bind brokers to organizations without manage-organizations keycloak-services: keycloak-services: OIDC redirect_uri fragment bypass in HTTP parameter pollution check keycloak-serv…</p> <p>keycloak-services: keycloak-services: Group hierarchy search discloses hidden parent groups under FGAP v2 keycloak-services: keycloak-services: Organization invitation link exposure allows unauthorized member creation keycloak-services: keycloak-services: Authorization codes can be retargeted to another client session keycloak-services: keycloak-services: Required signed-JWT assertion policy can be bypassed with unsigned assertion headers keycloak-services: keycloak-services: Authenticator config endpoint exposes raw reCAPTCHA secrets to view-only admins keycloak-services: keycloak-services: Missing per-role authorization on RoleContainerResource composite endpoints keycloak-services: keycloak-services: Incorrect authorization in admin role-composite deletion allows delegated admin to remove privileged child roles keycloak-services: keycloak-services: Realm default-group reads disclose hidden groups under FGAP v2 keycloak-services: keycloak-services: Information disclosure via role-users endpoint bypasses per-user view filter keycloak-services: keycloak-services: Privilege escalation via impersonation role allows takeover of realm administrator accounts resteasy-core: RESTeasy SourceProvider remote unauthenticated file read keycloak-services: keycloak-services: Generic identity-provider creation can bind brokers to organizations without manage-organizations keycloak-services: keycloak-services: OIDC redirect_uri fragment bypass in HTTP parameter pollution check keycloak-serv…</p> https://cve.radiocsirt.org/vuln/rhsa-2026:68277 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-2517 <p>Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in Keycloak ausnutzen, um Informationen offenzulegen.</p> <p>Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in Keycloak ausnutzen, um Informationen offenzulegen.</p> https://cve.radiocsirt.org/vuln/wid-sec-w-2026-2517