CVE-2026-2366: 
JavaScript vulnerability analysis and mitigation

CVE-2026-2366 is an authorization bypass vulnerability in the Keycloak Admin API that allows any authenticated user — regardless of administrative privileges — to enumerate the organization memberships of other users. The flaw affects Keycloak version 26.5.1 (and likely earlier versions with the Organizations feature enabled) and was first reported on February 11, 2026, with NVD publication on March 12, 2026. It carries a CVSS v3.1 base score of 3.1 (Low), reflecting the high attack complexity and limited confidentiality impact (Red Hat CVE, Red Hat Bugzilla).

The root cause is classified as CWE-639 (Authorization Bypass Through User-Controlled Key): the Admin API endpoint GET /admin/realms/{realm}/organizations/members/{member-id}/organizations fails to enforce proper permission checks before returning organization membership data. Any authenticated user who supplies a valid access token and a known victim UUID can query this endpoint and receive a 200 OK response with the full list of the victim's organization memberships, instead of the expected 403 Forbidden. Exploitation requires three preconditions: the Organizations feature must be enabled (default in recent versions), the attacker must hold a valid realm access token, and the attacker must know the target user's UUID. The vulnerable component is org.keycloak.services.resources.admin.organizations (Red Hat Bugzilla).

Successful exploitation results in unauthorized disclosure of user organization membership data, a confidentiality breach with no impact on integrity or availability. An attacker can map which organizations a target user belongs to, potentially enabling targeted social engineering, privilege escalation planning, or reconnaissance for further attacks within multi-tenant Keycloak deployments. The scope is limited to the affected realm and does not provide direct access to credentials or administrative functions (Red Hat Bugzilla, Red Hat CVE).

No public proof-of-concept exploit code or in-the-wild exploitation has been reported as of the available data. The EPSS score is approximately 0.025% (0.000250), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been identified (Red Hat CVE).

1. Reconnaissance: Identify a Keycloak instance with the Organizations feature enabled (default in recent versions). Confirm the target realm and obtain the victim user's UUID — this may be discoverable via other API calls, directory enumeration, or social engineering.
2. Obtain access token: Authenticate to the target Keycloak realm as any low-privileged user (no admin roles required) and retrieve a valid OIDC access token via the standard token endpoint (e.g., POST /realms/{realm}/protocol/openid-connect/token).
3. Send crafted API request: Issue a GET request to the vulnerable endpoint using the low-privileged token as a Bearer token:

   GET /admin/realms/{realm}/organizations/members/{victim-uuid}/organizations
   Authorization: Bearer <low-privileged-access-token>

4. Collect disclosed data: Observe the 200 OK response containing the full list of the victim's organization memberships, which should have returned 403 Forbidden for a non-admin user (Red Hat Bugzilla).

• Network: Repeated GET requests to /admin/realms/{realm}/organizations/members/{uuid}/organizations from non-administrative user accounts; requests targeting multiple different UUIDs from the same source IP in a short timeframe.
• Logs: Keycloak access logs showing 200 OK responses to the above endpoint for users without admin roles; absence of corresponding 403 Forbidden responses that would be expected for low-privileged accounts.
• Behavioral: A single authenticated session making bulk queries to the organizations membership endpoint across many user UUIDs, suggesting automated enumeration.

Keycloak upstream released version 26.5.6 which addresses this vulnerability (Keycloak Release, Keycloak Blog). Red Hat issued security advisories RHSA-2026:6477 and RHSA-2026:6478 on April 2, 2026, providing patched Red Hat build of Keycloak 26.4.11 packages and container images for OpenShift (RHSA-2026:6477, RHSA-2026:6478). As a workaround, administrators who do not require the Organizations feature can disable it to eliminate the attack surface. Upgrading to the patched version is the recommended remediation.

The vulnerability was discovered and reported by Reynaldo Immanuel and Joy Gilbert, as acknowledged in the Red Hat Bugzilla entry (Red Hat Bugzilla). Community discussion was noted on Bluesky and aggregated by vulnerability tracking services shortly after NVD publication in March 2026. Given the low CVSS score and limited impact, the vulnerability did not generate significant media coverage or widespread community concern.