CVE-2026-97311
📛 CVE Title
Keycloak-services: keycloak-services: admin rest api role-groups endpoint discloses groups without authorization
Description
A flaw was found in the Admin REST API of Keycloak, an identity and access management solution. The endpoints used to retrieve groups associated with a specific role do not properly check for individual group visibility permissions. This allows a delegated administrator with basic search privileges to view detailed information about all groups assigned to a role, bypassing intended security restrictions that should limit their view to specific groups.
Overview
- State
- PUBLISHED
- Assigner (CNA)
- redhat
- CVSS severity
- MEDIUM
- CVSS score
- 4.3 / 10
- CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N- Effective score
- 4.3 / 10 MEDIUM source: CNA overview
- CWE(s)
-
CWE-862 - Reserved
- 2026-09-24
- Published
- 2026-09-24 11:28 UTC
- Last updated
- 2026-09-24 12:31 UTC
- Source
- https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/97xxx/CVE-2026-97311.json
NVD / KEV / EPSS data refreshed 2026-09-25 04:27 UTC. Re-run the 🛰 Backfill from NVD button above to refresh.
European Union Vulnerability Database ENISA EUVD
ENISA's official EU repository for curated vulnerability intelligence. Carries a separate identifier (EUVD-YYYY-NNNN) and frequently exposes an earlier-published description + CVSS than NVD does.
- EUVD ID
-
EUVD-2026-85853 - Assigner
- redhat
- Published
- Sep 24, 2026, 11:28:39 AM
- Updated
- Sep 24, 2026, 12:31:31 PM
- EUVD base score (CVSS 3.1)
-
4.3 / 10
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N - EUVD-reported EPSS
- 0.0000
- Aliases
-
GHSA-rc25-9gwp-h85r
ENISA description: A flaw was found in the Admin REST API of Keycloak, an identity and access management solution. The endpoints used to retrieve groups associated with a specific role do not properly check for individual group visibility permissions. This allows a delegated administrator with basic search privileges to view detailed information about all groups assigned to a role, bypassing intended security restrictions that should limit their view to specific groups.
EUVD references (1)
Affected products (3)
| Vendor | Product | Versions | Platforms |
|---|---|---|---|
| Red Hat | Red Hat Build of Keycloak | — | — |
| Red Hat | Red Hat Build of Keycloak | — | — |
| Red Hat | Red Hat Single Sign-On 7 | — | — |
Vendor references (1)
References embedded in the original CVE record by the assigning CNA.
- https://access.redhat.com/security/cve/CVE-2026-97311 vdb-entryx_refsource_REDHAT
Web references (0)
DuckDuckGo results ranked by threat-intel / vendor advisory domains. Generated by the 🔎 Find references (web) button above — same flow as the Remediations search.
No web references attached yet.
Remediations (10)
-
web:access.redhat.com
Statement The Red Hat Product Security team has assessed the severity of this vulnerability as Moderate, given that exploitation requires the attacker to already possess delegated administrative privileges. Successful exploitation allows an attacker to bypass fine-grained visibility controls to disclose group metadata and membership information. The vulnerability's root cause is a missing ...
2026-09-25 10:43 UTC -
web:anonhaven.com
A flaw was found in the Admin REST API of Keycloak, an identity and access management solution. The endpoints used to retrieve groups associated with a specific role do not properly check for individual group visibility permissions. This allows a delegated administrator with basic search privileges to view detailed information …
2026-09-25 10:43 UTC -
web:cvealert.net
CVE-2026-97311 - MEDIUM vulnerability with CVSS score 4.3
2026-09-25 10:43 UTC -
web:cvefeed.io
The following list is the news that have been mention CVE-2026-97311 vulnerability anywhere in the article. Results are limited to the first 20 news articles due to potential performance issues. The following table lists the changes that have been made to the CVE-2026-97311 vulnerability over time.
2026-09-25 10:43 UTC -
web:cvetodo.com
CVE-2026-97311 is a CVSS 4.3 medium-severity vulnerability in Red Hat products. Full technical analysis, mitigations , and exploit status — updated in real time.
2026-09-25 10:43 UTC -
web:vulners.com
CVE-2026-97311 🗓️ 24 Sep 2026 04:28:39 Reported by redhat Type cve 🔗 web.nvd.nist.gov 👁 8 Views
2026-09-25 10:43 UTC -
web:www.cvefind.com
Full details for CVE-2026-97311 : technical description, impact, CVSS/EPSS scores, linked CWE, CAPEC, affected CPEs, disclosure date, and mitigation options.
2026-09-25 10:43 UTC -
web:www.ibm.com
Remediation /Fixes IBM strongly recommends addressing the vulnerability now by applying a currently available interim fix or fix pack that contains the fix for APAR PH71453. For IBM WebSphere Application Server traditional: For V9.0.0.0 through 9.0.5.28: · Upgrade to minimal fix pack levels as required by the interim fix and then apply the Interim Fix that resolves PH71453 -- OR -- · Apply Fix ...
2026-09-25 10:43 UTC -
web:www.rapid7.com
CVE-2026-97311 : Red Hat: A flaw was found in the Admin REST API of Keycloak, an identity and access management solution. View severity, references, and remediation details from Rapid7.
2026-09-25 10:43 UTC -
web:www.strix.ai
How severe is CVE-2026-97311 ? CVE-2026-97311 has a CVSS score of 4.3/10 (MEDIUM severity). How do I fix CVE-2026-97311 ? Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.
2026-09-25 10:43 UTC
AI Forensic Analysis
Only Available for Registered Users. Sign in to view.
Raw JSON
The full cvelistV5 record. Download as CVE-2026-97311.json.
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-97311",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-24T12:31:24.446908Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-24T12:31:31.053Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:build_keycloak:"
],
"defaultStatus": "affected",
"packageName": "keycloak-services",
"product": "Red Hat Build of Keycloak",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:build_keycloak:"
],
"defaultStatus": "affected",
"packageName": "rhbk/keycloak-rhel9",
"product": "Red Hat Build of Keycloak",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:red_hat_single_sign_on:7"
],
"defaultStatus": "unaffected",
"packageName": "keycloak-services",
"product": "Red Hat Single Sign-On 7",
"vendor": "Red Hat"
}
],
"credits": [
{
"lang": "en",
"value": "Red Hat would like to thank Nomit Vyas for reporting this issue."
}
],
"datePublic": "2026-09-22T14:36:19.000Z",
"descriptions": [
{
"lang": "en",
"value": "A flaw was found in the Admin REST API of Keycloak, an identity and access management solution. The endpoints used to retrieve groups associated with a specific role do not properly check for individual group visibility permissions. This allows a delegated administrator with basic search privileges to view detailed information about all groups assigned to a role, bypassing intended security restrictions that should limit their view to specific groups."
}
],
"metrics": [
{
"other": {
"content": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"value": "Moderate"
},
"type": "Red Hat severity rating"
}
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-24T11:28:39.551Z",
"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"shortName": "redhat"
},
"references": [
{
"tags": [
"vdb-entry",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/security/cve/CVE-2026-97311"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-09-22T14:36:19.000Z",
"value": "Reported to Red Hat."
},
{
"lang": "en",
"time": "2026-09-22T14:36:19.000Z",
"value": "Made public."
}
],
"title": "Keycloak-services: keycloak-services: admin rest api role-groups endpoint discloses groups without authorization",
"workarounds": [
{
"lang": "en",
"value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."
}
],
"x_generator": {
"engine": "cvelib 1.8.0"
},
"x_redhatCweChain": "CWE-862: Missing Authorization"
}
},
"cveMetadata": {
"assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"assignerShortName": "redhat",
"cveId": "CVE-2026-97311",
"datePublished": "2026-09-24T11:28:39.551Z",
"dateReserved": "2026-09-24T10:58:09.463Z",
"dateUpdated": "2026-09-24T12:31:31.053Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}