CVE-2026-0871
published 2026-02-27CVE-2026-0871: A flaw was found in Keycloak. An administrator with `manage-users` permission can bypass the "Only administrators can view" setting for unmanaged attributes…
PriorityP430medium4.9CVSS 3.1
AVNACLPRHUINSUCNIHAN
EPSS
0.31%
22.7th percentile
A flaw was found in Keycloak. An administrator with `manage-users` permission can bypass the "Only administrators can view" setting for unmanaged attributes, allowing them to modify these attributes. This improper access control can lead to unauthorized changes to user profiles, even when the system is configured to restrict such modifications.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| redhat | build_of_keycloak | < 26.4.9 | 26.4.9 |
| redhat | keycloak | < 26.4.0 | 26.4.0 |
CVSS provenance
nvdv3.14.9MEDIUMCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N
vendor_redhat4.9MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
org.keycloak/keycloak-services: Keycloak: Unauthorized modification of unmanaged user attributes by administrators
vendor_redhat·2025-01-13·CVSS 4.9
CVE-2026-0871 [MEDIUM] CWE-266 org.keycloak/keycloak-services: Keycloak: Unauthorized modification of unmanaged user attributes by administrators
org.keycloak/keycloak-services: Keycloak: Unauthorized modification of unmanaged user attributes by administrators
A flaw was found in Keycloak. An administrator with `manage-users` permission can bypass the "Only administrators can view" setting for unmanaged attributes, allowing them to modify these attributes. This improper access control can lead to unauthorized changes to user profiles, even when the system is configured to restrict such modifications.
A flaw was found in Keycloak. An administrator with `manage-users` permission can bypass the "Only administrators can view" setting for unmanaged attributes, allowing them to modify these attributes. This improper access control can lead to unauthorized changes to user profiles, even when the system is configured to restrict such modi
OSV
Keycloak Server Private SPI: Improper Access Control Allows Administrators to Bypass Attribute Visibility Restrictions and Modify Unmanaged User Profile Attributes
osv·2026-02-27
CVE-2026-0871 [MEDIUM] Keycloak Server Private SPI: Improper Access Control Allows Administrators to Bypass Attribute Visibility Restrictions and Modify Unmanaged User Profile Attributes
Keycloak Server Private SPI: Improper Access Control Allows Administrators to Bypass Attribute Visibility Restrictions and Modify Unmanaged User Profile Attributes
A flaw was found in Keycloak. An administrator with `manage-users` permission can bypass the "Only administrators can view" setting for unmanaged attributes, allowing them to modify these attributes. This improper access control can lead to unauthorized changes to user profiles, even when the system is configured to restrict such modifications.
GHSA
Keycloak Server Private SPI: Improper Access Control Allows Administrators to Bypass Attribute Visibility Restrictions and Modify Unmanaged User Profile Attributes
ghsa·2026-02-27
CVE-2026-0871 [MEDIUM] CWE-266 Keycloak Server Private SPI: Improper Access Control Allows Administrators to Bypass Attribute Visibility Restrictions and Modify Unmanaged User Profile Attributes
Keycloak Server Private SPI: Improper Access Control Allows Administrators to Bypass Attribute Visibility Restrictions and Modify Unmanaged User Profile Attributes
A flaw was found in Keycloak. An administrator with `manage-users` permission can bypass the "Only administrators can view" setting for unmanaged attributes, allowing them to modify these attributes. This improper access control can lead to unauthorized changes to user profiles, even when the system is configured to restrict such modifications.
No detection rules found.
No public exploits indexed.
Wiz
CVE-2026-0871 Impact, Exploitability, and Mitigation Steps | Wiz
blogs_wiz·CVSS 4.9
CVE-2026-0871 [MEDIUM] CVE-2026-0871 Impact, Exploitability, and Mitigation Steps | Wiz
## CVE-2026-0871 :
Java vulnerability analysis and mitigation
manage-users
Source : NVD
## 4.9
Score
Published February 27, 2026
Severity MEDIUM
CNA Score 4.9
Affected Technologies
Java
Keycloak
Has Public Exploit No
Has CISA KEV Exploit No
CISA KEV Release Date N/A
CISA KEV Due Date N/A
Exploitation Probability Percentile (EPSS) 10
Exploitation Probability (EPSS) N/A
Affected packages and libraries
keycloak
keycloak-fips
Sources
NVD
Maven Severity MEDIUM Has Fix Added at: Mar 02, 2026
MinimOS Severity MEDIUM Has Fix Added at: Mar 02, 2026
Nix Severity MEDIUM Has Fix Added at: Mar 08, 2026
## Get a CVE risk assessment
Get a prioritized view of CVEs in your cloud—so you can focus on what's exploitable, not just what's listed.
## Related Java vulnerabilities:
Bugzilla
CVE-2026-0871 org.keycloak/keycloak-services: Keycloak: Unauthorized modification of unmanaged user attributes by administrators
bugzilla·2026-01-13·CVSS 4.9
CVE-2026-0871 [MEDIUM] CVE-2026-0871 org.keycloak/keycloak-services: Keycloak: Unauthorized modification of unmanaged user attributes by administrators
CVE-2026-0871 org.keycloak/keycloak-services: Keycloak: Unauthorized modification of unmanaged user attributes by administrators
Summary
When the Unmanaged Attributes is set to Only administrators can view, the administrator that has `manage-users` permission can anyway edit the unmanaged attributes. For example using curl or kcsdm.sh:
./kcadm.sh update users/b0df9d35-3319-4e87-81ea-9a906372fa1f -r sample -s "attributes.lala=lala"
Requirements to exploit
The realm should be configured unmanaged attributes to `Only administrators can view` and the admin should have permissions to edit users.
Component affected:
org.keycloak:keycloak-services
Version affected: Genaral tab -> unmanaged attributes to `Only administrators can view`.
Use kcadm (for example to edit the user with an admin
2026-02-27
Published