CVE-2026-2366
published 2026-03-12CVE-2026-2366: A flaw was found in Keycloak. An authorization bypass vulnerability in the Keycloak Admin API allows any authenticated user, even those without administrative…
PriorityP414low3.1CVSS 3.1
AVNACHPRLUINSUCLINAN
EPSS
0.27%
18.7th percentile
A flaw was found in Keycloak. An authorization bypass vulnerability in the Keycloak Admin API allows any authenticated user, even those without administrative privileges, to enumerate the organization memberships of other users. This information disclosure occurs if the attacker knows the victim's unique identifier (UUID) and the Organizations feature is enabled.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| keycloak | keycloak-admin-client | 0 – 26.5.5 | — |
| redhat | build_of_keycloak | >= 26.4 < 26.4.11 | 26.4.11 |
CVSS provenance
nvdv3.13.1LOWCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N
vendor_redhat7.0MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
Red Hat Keycloak 26.5.1 Admin API authorization (Nessus ID 305939)
vuldb·2026-04-11·CVSS 3.1
CVE-2026-2366 [LOW] Red Hat Keycloak 26.5.1 Admin API authorization (Nessus ID 305939)
A vulnerability described as problematic has been identified in Red Hat Keycloak 26.5.1. This issue affects some unknown processing of the component Admin API. The manipulation results in authorization bypass.
This vulnerability is identified as CVE-2026-2366. The attack can be executed remotely. There is not any exploit available.
GHSA
Keycloak vulnerable to authorization bypass via the Admin API
ghsa·2026-03-12
CVE-2026-2366 [LOW] CWE-639 Keycloak vulnerable to authorization bypass via the Admin API
Keycloak vulnerable to authorization bypass via the Admin API
A flaw was found in Keycloak. An authorization bypass vulnerability in the Keycloak Admin API allows any authenticated user, even those without administrative privileges, to enumerate the organization memberships of other users. This information disclosure occurs if the attacker knows the victim's unique identifier (UUID) and the Organizations feature is enabled.
OSV
Keycloak vulnerable to authorization bypass via the Admin API
osv·2026-03-12
CVE-2026-2366 [LOW] Keycloak vulnerable to authorization bypass via the Admin API
Keycloak vulnerable to authorization bypass via the Admin API
A flaw was found in Keycloak. An authorization bypass vulnerability in the Keycloak Admin API allows any authenticated user, even those without administrative privileges, to enumerate the organization memberships of other users. This information disclosure occurs if the attacker knows the victim's unique identifier (UUID) and the Organizations feature is enabled.
Red Hat
keycloak: Keycloak: Information disclosure via authorization bypass in Admin API
vendor_redhat·2026-02-11·CVSS 3.1
CVE-2026-2366 [LOW] CWE-639 keycloak: Keycloak: Information disclosure via authorization bypass in Admin API
keycloak: Keycloak: Information disclosure via authorization bypass in Admin API
A flaw was found in Keycloak. An authorization bypass vulnerability in the Keycloak Admin API allows any authenticated user, even those without administrative privileges, to enumerate the organization memberships of other users. This information disclosure occurs if the attacker knows the victim's unique identifier (UUID) and the Organizations feature is enabled.
A flaw was found in Keycloak. An authorization bypass vulnerability in the Keycloak Admin API allows any authenticated user, even those without administrative privileges, to enumerate the organization memberships of other users. This information disclosure occurs if the attacker knows the victim's unique identifier (UUID) and the Organizations featu
No detection rules found.
No public exploits indexed.
Wiz
CVE-2026-2366 Impact, Exploitability, and Mitigation Steps | Wiz
blogs_wiz·CVSS 3.1
CVE-2026-2366 [LOW] CVE-2026-2366 Impact, Exploitability, and Mitigation Steps | Wiz
## CVE-2026-2366 :
JavaScript vulnerability analysis and mitigation
A flaw was found in Keycloak. An authorization bypass vulnerability in the Keycloak Admin API allows any authenticated user, even those without administrative privileges, to enumerate the organization memberships of other users. This information disclosure occurs if the attacker knows the victim's unique identifier (UUID) and the Organizations feature is enabled.
Source : NVD
## 3.1
Score
Published March 12, 2026
Severity LOW
CNA Score 3.1
Affected Technologies
JavaScript
Java
Has Public Exploit No
Has CISA KEV Exploit No
CISA KEV Release Date N/A
CISA KEV Due Date N/A
Exploitation Probability Percentile (EPSS) 8.4
Exploitation Probability (EPSS) N/A
Affected packages and libraries
org.keycloak:keycloa
Bugzilla
CVE-2026-90189 kernel: null_blk: register configfs subsystem after creating default devices
bugzilla·2026-09-17
CVE-2026-90189 [MEDIUM] CVE-2026-90189 kernel: null_blk: register configfs subsystem after creating default devices
CVE-2026-90189 kernel: null_blk: register configfs subsystem after creating default devices
In the Linux kernel, the following vulnerability has been resolved:
null_blk: register configfs subsystem after creating default devices
In null_init(), configfs_register_subsystem() currently runs before
register_blkdev(), so when null_blk is built as a module, a racing mkdir()
+ poweron from userspace can reach null_add_dev() while null_major is still
0. __add_disk() then hits WARN_ON(disk->minors) (major=0 with minors!=0)
and fails:
[root@fedora ~]# [ 2366.521436] WARNING: block/genhd.c:476 at __add_disk+0x8a7/0xde0,
[ 2366.523552] Modules linked in: null_blk(+) nft_fib_inet nft_fib_ipv4 nft_fib_ipv6 nft_fib
[ 2366.529081] CPU: 26 UID: 0 PID: 1600 Comm: sh Not tainted 7.2.0-rc1+ #66 PREEMPT(f
2026-03-12
Published