CVE-2026-0871: 
Java vulnerability analysis and mitigation

CVE-2026-0871 is an improper access control vulnerability in Keycloak (and Red Hat build of Keycloak) that allows an administrator with manage-users permission to bypass the "Only administrators can view" restriction on unmanaged user attributes, enabling unauthorized modification of those attributes. It affects Keycloak versions prior to 26.4.0 and Red Hat build of Keycloak versions prior to 26.4.9. The vulnerability was reported on January 13, 2026, and publicly disclosed on February 27, 2026. It carries a CVSS v3.1 base score of 4.9 (Medium) (Red Hat CVE, Red Hat Bugzilla).

The root cause is classified as CWE-266 (Incorrect Privilege Assignment): Keycloak's keycloak-services component fails to enforce the "Only administrators can view" restriction on unmanaged attributes when an administrator with manage-users permission issues update requests. The flaw allows such administrators to write arbitrary values to unmanaged user attributes — for example, via the kcadm.sh update users/<user-id> command or direct API calls — even when the realm is configured to restrict such modifications. Exploitation requires the realm to have unmanaged attributes set to "Only administrators can view" and the attacker to hold a manage-users privileged account (Red Hat Bugzilla, Red Hat CVE).

Successful exploitation allows a privileged administrator to make unauthorized changes to user profile attributes that are intended to be immutable or restricted, potentially corrupting sensitive user data or bypassing attribute-based access controls within the Keycloak realm. There is no confidentiality or availability impact; the risk is limited to integrity of user profile data. While lateral movement is not directly enabled, tampering with user attributes could undermine downstream authorization decisions that rely on those attributes (Red Hat Bugzilla, Red Hat CVE).

1. Precondition: Obtain or compromise an administrator account with manage-users permission in a Keycloak realm where unmanaged attributes are configured to "Only administrators can view."
2. Identify target user: Enumerate users in the realm using the Keycloak Admin API or kcadm.sh to identify the target user's UUID.
3. Craft update request: Use the Keycloak Admin CLI or a direct REST API call to update the target user's unmanaged attributes, e.g.:

   ./kcadm.sh update users/<user-uuid> -r <realm> -s "attributes.sensitiveAttr=maliciousValue"

4. Bypass restriction: Despite the realm configuration restricting modification of unmanaged attributes, the server processes the update without error, writing the attacker-controlled value to the user profile.
5. Verify impact: Confirm the attribute change via the Keycloak Admin Console or API, observing that the restricted attribute now reflects the unauthorized value (Red Hat Bugzilla).

• Logs: Keycloak audit/event logs showing UPDATE events on user resources (UPDATE_USER) by an administrator account with manage-users role, particularly targeting attributes not normally modified by that account.
• Logs: Admin REST API access logs recording PUT /admin/realms/<realm>/users/<user-id> requests with attribute payloads that include unmanaged attribute names.
• Application: Unexpected or anomalous values appearing in user profile attributes that are designated as unmanaged within the realm configuration, visible in the Keycloak Admin Console under user details.

Red Hat has released patches addressing this vulnerability: update Keycloak to version 26.4.0 or later, or Red Hat build of Keycloak to version 26.4.9 or later. Security advisories RHSA-2026:2365 (standalone packages) and RHSA-2026:2366 (OpenShift container images) are available from the Red Hat Customer Portal. As an interim measure, review and audit all administrator accounts holding manage-users permissions, and implement additional monitoring for unexpected user attribute modifications until patching is complete (RHSA-2026:2365, RHSA-2026:2366).