Keycloak Server Private SPI: Improper Access Control Allows Administrators to Bypass Attribute Visibility Restrictions and Modify Unmanaged User Profile Attributes

中 4.9CVE-2026-0871 · BIT-keycloak-2026-0871 · GHSA-v4jw-m6rm-399h · 27/02/2026 公開 · 17/06/2026 更新

要点

CVE-2026-0871 は org.keycloak:keycloak-server-spi-private, build of keycloak (redhat), keycloak (redhat) に影響する深刻度「中」 (CVSS 4.9) の脆弱性です。
今後30日間に悪用される確率（EPSS）：0.35%（全脆弱性の 28.5% より高い）。
対処：26.5.2, 26.4.9, 26.4.0 以降に更新してください。

パッケージ	影響を受けるバージョン	修正済みバージョン
org.keycloak:keycloak-server-spi-private Maven	`< 26.5.2`	`26.5.2`
build of keycloak redhat	`< 26.4.9`	`26.4.9`
keycloak redhat	`< 26.4.0`	`26.4.0`

概要

A flaw was found in Keycloak. An administrator with manage-users permission can bypass the "Only administrators can view" setting for unmanaged attributes, allowing them to modify these attributes. This improper access control can lead to unauthorized changes to user profiles, even when the system is configured to restrict such modifications.

NVD の説明

A flaw was found in Keycloak. An administrator with `manage-users` permission can bypass the "Only administrators can view" setting for unmanaged attributes, allowing them to modify these attributes. This improper access control can lead to unauthorized changes to user profiles, even when the system is configured to restrict such modifications.