CVE-2026-2366

LowCVSS 3.1/10Last modified Aug 18, 2026

Description

A flaw was found in Keycloak. An authorization bypass vulnerability in the Keycloak Admin API allows any authenticated user, even those without administrative privileges, to enumerate the organization memberships of other users. This information disclosure occurs if the attacker knows the victim's unique identifier (UUID) and the Organizations feature is enabled.

Metrics

CVSS 3.1 3.1/10CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-639

Affected software

VendorProductVersions
Red HatRed Hat build of Keycloak 26.4—
Red HatRed Hat build of Keycloak 26.4—
Red HatRed Hat build of Keycloak 26.4—
Red HatRed Hat build of Keycloak 26.4.11—

References

Timeline

Published
Mar 12, 2026
Last modified
Aug 18, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-236607.8Improper access control in Azure Portal Windows Admin Center allows an authorized attacker to elevate privileges locally.CVE-2026-236617.5Cleartext transmission of sensitive information in Azure IoT Explorer allows an unauthorized attacker to disclose information over a networkCVE-2026-236627.5Missing authentication for critical function in Azure IoT Explorer allows an unauthorized attacker to disclose information over a network.CVE-2026-236637.5Improper privilege management in Azure Entra ID allows an unauthorized attacker to elevate privileges over a network.CVE-2026-236647.5Improper restriction of communication channel to intended endpoints in Azure IoT Explorer allows an unauthorized attacker to disclose informCVE-2026-236657.8Heap-based buffer overflow in Azure Linux Virtual Machines allows an authorized attacker to elevate privileges locally.CVE-2026-236667.5Improper input validation in .NET Framework allows an unauthorized attacker to deny service over a network.CVE-2026-236677.0Use after free in Broadcast DVR allows an authorized attacker to elevate privileges locally.CVE-2026-236687.0Concurrent execution using shared resource with improper synchronization ('race condition') in Microsoft Graphics Component allows an authorCVE-2026-236698.8Use after free in RPC Runtime allows an authorized attacker to execute code over a network.CVE-2026-23676.4The Secure Copy Content Protection and Content Locking plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'aCVE-2026-236705.7Untrusted pointer dereference in Windows Virtualization-Based Security (VBS) Enclave allows an authorized attacker to bypass a security feat
CVE-2026-2366: Low severity, CVSS 3.1 | Vulnix