Is CVE-2026-16072 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-16072 being exploited in the wild.

How severe is CVE-2026-16072?

Medium severity, with a CVSS score of 4.9, published 17 July 2026.

Which products and versions are affected?

Red Hat build of Keycloak unspecified.

Is there a fix for CVE-2026-16072?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-16072 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-16072?

Check whether you run Red Hat build of Keycloak at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-16072: Keycloak permission bypass in organization management component

CVE-2026-16072 · Severity: medium · CVSS 4.9 · Published 2026-07-17

A security flaw in Keycloak, a popular identity and access management solution, allows certain administrators to bypass security restrictions. A delegated administrator with permission to manage organizations can create unauthorized user accounts and add them to an organization without having the necessary user management permissions. This could lead to unauthorized access and the creation of rogue accounts within a corporate environment.

Technologies: Red Hat build of Keycloak. Vendors: Red Hat.

Quick answers

Is CVE-2026-16072 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-16072 being exploited in the wild.
How severe is CVE-2026-16072?: Medium severity, with a CVSS score of 4.9, published 17 July 2026.
Which products and versions are affected?: Red Hat build of Keycloak unspecified.
Is there a fix for CVE-2026-16072?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-16072 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-16072?: Check whether you run Red Hat build of Keycloak at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A permission bypass vulnerability exists in the Keycloak organization REST API's handling of pending invitations. A delegated administrator with 'manage-organizations' permissions but lacking 'manage-users' permissions can create an invitation for an arbitrary email address. The API response for listing pending invitations improperly includes the 'inviteLink' containing a bearer token. An attacker can retrieve this link via the API and use it to register new managed members directly, bypassing both the 'manage-users' permission requirement and the email ownership verification step. This allows for the creation of unauthorized managed user accounts associated with an organization.

Affected products

Red Hat Red Hat Build of Keycloak unspecified

Timeline

2026-07-17: disclosed: CVE published and Red Hat advisory released

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.