AUGUST 4, 2026
Live Feed
Back to database
Case File

CVE-2026-2366

LOW · CVSS 3.1 EPSS 0.27%

Source: NVD + CISA KEV + EPSS (historical backfill) · Published 2026-03-12 · Last synced 2026-08-04

CyberRota Analysis

This is a low severity vulnerability with a CVSS score of 3.1. Exploitation may require the attacker to be authenticated.

CVE
CVE-2026-2366
Severity
LOW
CVSS
3.1
EPSS
0.27%

Original NVD Description

A flaw was found in Keycloak. An authorization bypass vulnerability in the Keycloak Admin API allows any authenticated user, even those without administrative privileges, to enumerate the organization memberships of other users. This information disclosure occurs if the attacker knows the victim's unique identifier (UUID) and the Organizations feature is enabled.