CVE-2026-9088
Low · 2.7CVSS
2.7
EPSS
0.4%
Published
Jun 5, 2026
CISA due date
—
The record
A flaw was found in org.keycloak.services. An administrator with delegated access to read group memberships and users can bypass user profile permissions by accessing the group members endpoint. This allows the administrator to view user attributes that are explicitly configured to be denied, leading to information disclosure.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-96372 Insufficient Granularity of Access Control vulnerability in Drupal Webform allows… CWE-1220
- CVE-2026-78230 AshAi exposes Ash read actions to language-model tool calls. CWE-1220
- CVE-2026-78216 AshLua exposes Ash read actions to Lua scripts run through an eval action. CWE-1220
- CVE-2026-15431 A potential security vulnerability has been identified in the HP Support Assistant for… CWE-1220
- CVE-2026-40145 A vulnerability exists in the interaction between a Endpoint Privilege Management… CWE-1220
- CVE-2025-31938 Insufficient granularity of access control in some subsystem for some Intel(R) Xeon(R) 6… CWE-1220
- CVE-2026-50502 Insufficient granularity of access control in Windows Event Logging Service allows an… CWE-1220
- CVE-2026-50405 Insufficient granularity of access control in Windows Filtering Platform (WFP) allows an… CWE-1220