CVE-2026-116470

A flaw was found in the SCIM user listing endpoint of Keycloak, an open-source identity and access management solution. The issue occurs because the endpoint fails to perform per-user VIEW authorization checks when returning user lists. This allows a service account or user with limited query...