CVE-2026-9088: Keycloak Services Information Disclosure via User Profile Permission Bypass
Summary
CVE-2026-9088: Keycloak: Information disclosure due to user profile permission bypass. Affects org.keycloak:keycloak-services versions < 26.7.0. Fixed in 26.7.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Keycloak is an open-source identity and access management solution designed for modern applications and services. It provides features such as single sign-on, user federation, identity brokering, and social login. The 'keycloak-services' package is a core component that manages user authentication and authorization. However, it has been identified to have a vulnerability that allows unauthorized access to sensitive user information.
Vulnerability Detail
A flaw exists in the org.keycloak.services package where an administrator with delegated access can bypass user profile permissions. This occurs when accessing the group members endpoint, allowing the administrator to view user attributes that should be denied. The vulnerability can lead to unauthorized information disclosure, potentially exposing sensitive user data.
How To Fix
Latest published version: 26.8.1 as of 23 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
26.7.0
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, administrators should refrain from using the group members endpoint until the package is updated to the patched version. Additionally, review and restrict delegated access permissions to limit exposure to sensitive user attributes.
Conclusion
In summary, CVE-2026-9088 is a significant vulnerability in Keycloak's 'keycloak-services' package that allows unauthorized access to user information. It is crucial to update to version 26.7.0 or later to mitigate this risk. Administrators should also consider temporary workarounds while awaiting the update.
See every vulnerability recorded for org.keycloak:keycloak-services →
FAQ
CVE-2026-9088 is a vulnerability in Keycloak that allows administrators to bypass user profile permissions, leading to potential information disclosure.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without any signup.
The primary risk is unauthorized access to sensitive user information, which could lead to privacy violations and data breaches.
The CVSS score of this vulnerability is 2.7, indicating a low severity level.
It is recommended to regularly check for updates to your dependencies and apply security patches as soon as they are available to mitigate vulnerabilities.
References
Related vulnerabilities
Recent vulnerabilities recorded for org.keycloak:keycloak-services.
