CVE-2026-16072

Name of the Vulnerable Software and Affected Versions Keycloak (affected versions not specified)

Description A flaw in the organization management component allows a delegated administrator with organization management permissions to bypass security boundaries. The administrator can create an invitation for a non-existent email address and retrieve the secret registration link via the application programming interface. This enables the creation of new user accounts and their addition to the organization without the necessary user management permissions or access to the invited email account.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.