CVE-2026-0871: Keycloak Server SPI - Improper Access Control Allows Unauthorized User Profile Modifications
Summary
CVE-2026-0871: A flaw was found in Keycloak. Affects org.keycloak:keycloak-server-spi-private versions < 26.5.2. Fixed in 26.5.2. How to fix ↓
Also tracked for
- keycloak · Bitnami
The same CVE-2026-0871 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Keycloak is an open-source identity and access management solution that provides authentication and authorization services for applications. It enables users to manage their identities and access rights across various platforms. The Keycloak Server SPI (Service Provider Interface) allows developers to extend Keycloak's capabilities. However, a recent vulnerability has been identified that affects the access control mechanisms within this package.
Vulnerability Detail
A flaw was discovered in Keycloak's Server Private SPI that allows administrators with 'manage-users' permissions to bypass the visibility restrictions on unmanaged user attributes. This improper access control can lead to unauthorized modifications of user profiles, even in scenarios where the system is configured to prevent such changes. The vulnerability is classified under CWE-266 and CWE-284, indicating issues with improper privilege management and access control.
How To Fix
Latest published version: 26.8.1 as of 23 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
26.5.2
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can restrict access to the 'manage-users' permission for administrators until the package is updated. This can help mitigate the risk of unauthorized modifications to user profiles.
Conclusion
In summary, CVE-2026-0871 represents a significant security risk within Keycloak's Server SPI, allowing unauthorized modifications to user profiles due to improper access control. It is crucial for users to update to the patched version 26.5.2 to mitigate this risk and ensure the integrity of user data.
See every vulnerability recorded for org.keycloak:keycloak-server-spi-private →
FAQ
CVE-2026-0871 is a vulnerability in Keycloak's Server Private SPI that allows unauthorized modifications to user profiles due to improper access control.
Administrators with 'manage-users' permissions in Keycloak are primarily affected, as they can bypass attribute visibility restrictions.
The vulnerability can lead to unauthorized changes in user profiles, which may compromise user data and access rights.
You can use Vulert's playground at Vulert Scanner to check if your application is impacted by this vulnerability without any signup.
The CVSS score of this vulnerability is 4.9, indicating a moderate severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for org.keycloak:keycloak-server-spi-private.
