CVE-2026-9088

Name of the Vulnerable Software and Affected Versions Keycloak (affected versions not specified)

Description A flaw in org.keycloak.services allows an administrator with delegated access to read group memberships and users to bypass user profile permissions. By accessing the group members endpoint, the administrator can view user attributes that are explicitly configured to be denied, resulting in information disclosure.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.