CVE-2026-102132

An administrative import function in Kiteworks Core did not verify that the requesting administrator was entitled to create the privileged integration credential being imported. A delegated administrator holding a single narrowly scoped administrative permission could therefore obtain full system...

EUVD-2026-90285

An administrative import function in Kiteworks Core did not verify that the requesting administrator was entitled to create the privileged integration credential being imported. A delegated administrator holding a single narrowly scoped administrative permission could therefore obtain full system...

CVE-2026-97311

A flaw was found in the Admin REST API of Keycloak, an identity and access management solution. The endpoints used to retrieve groups associated with a specific role do not properly check for individual group visibility permissions. This allows a delegated administrator with basic search privileg...

CVE-2026-97311 Keycloak-services: keycloak-services: admin rest api role-groups endpoint discloses groups without authorization

A flaw was found in the Admin REST API of Keycloak, an identity and access management solution. The endpoints used to retrieve groups associated with a specific role do not properly check for individual group visibility permissions. This allows a delegated administrator with basic search privileg...

CVE-2026-97177

A flaw was found in the user update mechanism of the Keycloak Admin REST API. When Fine-Grained Admin Permissions are enabled, the system fails to check for specific password reset authorizations during a general user profile update. This allows a delegated administrator, who should be restricted...

CVE-2026-97311: Missing Authorization

A flaw was found in the Admin REST API of Keycloak, an identity and access management solution. The endpoints used to retrieve groups associated with a specific role do not properly check for individual group visibility permissions. This allows a delegated administrator with basic search privileg...

CVE-2026-94213

CVE-2026-94213 affects the Authorization Services component of Keycloak , an open-source identity and access management solution. The flaw resides in the policy evaluation endpoint , used by administrators to test how access policies apply to specific users. Due to missing authorization checks , ...

CVE-2026-94213 Keycloak-services: keycloak-services: authorization services policy evaluation endpoint leaks user identity

A flaw was found in the Authorization Services component of Keycloak, an open-source identity and access management solution. The issue occurs in the policy evaluation endpoint, which is used by administrators to test how access policies apply to specific users. Due to missing authorization check...

CVE-2026-94213: Missing Authorization

A flaw was found in the Authorization Services component of Keycloak, an open-source identity and access management solution. The issue occurs in the policy evaluation endpoint, which is used by administrators to test how access policies apply to specific users. Due to missing authorization check...

CVE-2026-94001: Missing Authorization

A flaw was found in the Admin REST API of Keycloak, an open-source identity and access management solution. The endpoint used for deleting user credentials does not correctly check for fine-grained reset-password permissions. This allows a delegated administrator, who should be restricted from...

keycloak-services: keycloak-services: Organization invitation link exposure allows unauthorized member creation

A flaw was found in the organization management component of Keycloak. A delegated administrator with permission to manage organizations can create an invitation for a non-existent email address and then retrieve the secret registration link directly through the application programming interface...

Astra Linux – Vulnerability in Samba

A vulnerability was discovered in Samba. A delegated administrator with permission to create objects in Active Directory can write to all attributes of the newly created object, including security-sensitive attributes, even after the object’s creation. This issue arises because the administrator...

BIT-KEYCLOAK-2026-16105 Keycloak-services: keycloak-services: missing per-role authorization on rolecontainerresource composite endpoints

A flaw was found in the RoleContainerResource component of Keycloak. The issue occurs because certain name-based endpoints in the admin REST API do not properly enforce authorization checks when managing composite roles. This allows a delegated administrator with manage-realm permissions to remov...

BIT-KEYCLOAK-2026-17048 Keycloak-services: keycloak-services: vault-resolved rotated client secrets leaked via admin rest api

A flaw was found in the Keycloak Admin REST API, which is used to manage security realms and clients. The issue occurs when the system processes requests for rotated client secrets that are stored in a secure vault. Due to improper boundary enforcement, a delegated administrator with view-only...

Information Disclosure

Keycloak is vulnerable to information disclosure. The vulnerability is due to insufficient authorization checks in the default-groups REST endpoint and realm representation, which allows a delegated administrator with realm-viewing permissions to access the names and identifiers of hidden default...

Sensitive Information Disclosure

Keycloak is vulnerable to Sensitive Information Disclosure. The vulnerability is due to improper authorization when retrieving rotated client secrets stored in a secure vault, which allows a delegated administrator with view-only permissions to obtain the actual secret instead of the vault...

EUVD-2026-54520

Nexus Repository 3 CE/Pro versions 3.0.0 through 3.94.x contain an incorrect authorization vulnerability CWE-863 in the repository-creation user interface. An individual user account holding a delegated repository-admin privilege scoped to a specific repository format could create a repository of...

keycloak-services: keycloak: FGAP v2 parent group children endpoint bypasses per-child view permission filter

A flaw was found in the Fine-Grained Admin Permissions FGAP v2 implementation within Keycloak's administrative services. When FGAP v2 is enabled, the system fails to properly filter child groups based on the caller's specific permissions when requested through a parent group. This allows a...

CVE-2026-16071

A flaw was found in the LDAP storage provider of Keycloak, which is used to federate user identities from external directories. The issue occurs when a delegated administrator performs a search using a specific LDAP entry Distinguished Name DN. Due to missing validation, the system allows lookups...

Access Control Bypass

Overview Affected versions of this package are vulnerable to Access Control Bypass in LDAPStorageProvider.searchLDAPByAttributes through LDAPENTRYDN lookups in federation/ldap/src/main/java/org/keycloak/storage/ldap/LDAPStorageProvider.java. A delegated administrator can retrieve and import...