GHSA-v4jw-m6rm-399h
Medium · 4.9CVSS
4.9
EPSS
—
Published
Feb 27, 2026
CISA due date
—
The record
Keycloak Server Private SPI: Improper Access Control Allows Administrators to Bypass Attribute Visibility Restrictions and Modify Unmanaged User Profile Attributes
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Maven | org.keycloak:keycloak-server-spi-private | 0 | 26.5.2 |
Related vulnerabilities
- CVE-2026-0871 A flaw was found in Keycloak. Same vulnerability
- CVE-2026-63349 AnyIO is a high level asynchronous concurrency and networking framework that works on top… CWE-266
- CVE-2026-62106 Subscriber Privilege Escalation in SMS Alert Order Notifications <= 3.9.9 versions. CWE-266
- CVE-2026-62102 Subscriber Privilege Escalation in Gato GraphQL <= 19.2.3 versions. CWE-266
- CVE-2026-8303 Incorrect privilege assignment vulnerability in TUBITAK BILGEM Software Technologies… CWE-266
- CVE-2026-81805 Unauthenticated Privilege Escalation in SiteSkite <= 2.1.5 versions. CWE-266
- CVE-2026-15140 A privilege-escalation issue in the Portworx Operator when deployed on Red Hat OpenShift… CWE-266
- CVE-2026-86804 A vulnerability was identified in seakee CPA-Manager-Plus up to 1.11.10. CWE-266