# CVE-2026-9088: Keycloak information disclosure via user profile permission bypass in group members endpoint

Source: https://junglewise.ai/threats/cve-2026-9088-keycloak-information-disclosure-via-user-profile-permission-bypass  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-05. Updated: 2026-07-16  
License: CC BY 4.0 with a link back

CVE-2026-9088 · Severity: low · CVSS 3.1 · Published 2026-06-05

Keycloak is an open-source identity and access management solution used to secure applications and services. A security flaw allows administrators with limited permissions to bypass profile restrictions and view sensitive user information they are not authorized to see. This could lead to the exposure of private user attributes, potentially compromising user privacy or organizational data policies.

Technologies: [Keycloak](https://junglewise.ai/threats/technologies/keycloak), [org.keycloak:keycloak-services (Maven)](https://junglewise.ai/threats/technologies/org-keycloak-keycloak-services), [Red Hat build of Keycloak 26.4](https://junglewise.ai/threats/technologies/red-hat-build-of-keycloak). Vendors: [Keycloak](https://junglewise.ai/threats/vendors/keycloak), [Maven](https://junglewise.ai/threats/vendors/maven), [Red Hat](https://junglewise.ai/threats/vendors/red-hat).

## Quick answers

**Is CVE-2026-9088 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-9088 being exploited in the wild.

**How severe is CVE-2026-9088?** Low severity, with a CVSS score of 3.1, published 5 June 2026.

**Which products and versions are affected?** Keycloak < 26.7.0; org.keycloak:keycloak-services (Maven) < 26.7.0, ECOSYSTEM:introduced=0,fixed=26.7.0; Red Hat build of Keycloak 26.4 < 26.4.13-1; Red Hat build of Keycloak 26.6 < 26.6.3-3.

**Is there a fix for CVE-2026-9088?** Yes. org.keycloak:keycloak-services (Maven): upgrade to 26.7.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-9088 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-9088?** Check whether you run Keycloak, org.keycloak:keycloak-services (Maven), Red Hat build of Keycloak 26.4 or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- org.keycloak:keycloak-services (Maven): upgrade to 26.7.0 or later

  ```sh
  # set org.keycloak:keycloak-services to 26.7.0 in your pom.xml or build.gradle
  ```


## Technical details

An information disclosure vulnerability exists in org.keycloak.services due to insufficient granularity of access control (CWE-1220). An administrator with delegated permissions to read group memberships and users can bypass configured user profile permissions by querying the group members endpoint. This allows the attacker to retrieve user attributes that are explicitly configured to be denied or hidden. The attack requires high privileges (delegated admin access) and is reachable over the network without user interaction. The issue is resolved in Keycloak version 26.7.0 and various Red Hat build of Keycloak maintenance releases.

## Affected products

- Keycloak Keycloak < 26.7.0
- Red Hat Red Hat build of Keycloak 26.6 < 26.6.3-3
- Red Hat Red Hat build of Keycloak 26.4 < 26.4.13-1

## Identifiers

- CVE-2026-9088
- GHSA-6g26-7cx5-mrrg

## Timeline

- 2026-05-20: disclosed: Initial report in Red Hat Bugzilla
- 2026-06-05: advisory: GitHub Advisory and NVD entry published
- 2026-06-10: patched: Red Hat released security advisories for patched versions

## References

- [https://access.redhat.com/security/cve/CVE-2026-9088](https://access.redhat.com/security/cve/CVE-2026-9088)
- [https://bugzilla.redhat.com/show_bug.cgi?id=2480179](https://bugzilla.redhat.com/show_bug.cgi?id=2480179)
- [https://access.redhat.com/errata/RHSA-2026:25098](https://access.redhat.com/errata/RHSA-2026:25098)
- [https://access.redhat.com/errata/RHSA-2026:25097](https://access.redhat.com/errata/RHSA-2026:25097)
- [https://access.redhat.com/errata/RHSA-2026:30049](https://access.redhat.com/errata/RHSA-2026:30049)

## Related threats

- [Keycloak login-failure storage synchronization error in MySQL/MariaDB](https://junglewise.ai/threats/cve-2026-112201-a-flaw-was-found-in-the-login-failure-storage-component-of)
- [Keycloak PKCE bypass in login after password reset](https://junglewise.ai/threats/cve-2026-125652-a-flaw-was-found-in-the-keycloak-services-component-of-keycloak)
- [Keycloak server arbitrary code execution in client authorization](https://junglewise.ai/threats/cve-2026-120984-a-flaw-was-found-in-the-keycloak-server-s-client-management)
- [Keycloak token sanitization bypass in protocol mapper](https://junglewise.ai/threats/cve-2026-97848-a-flaw-was-found-in-the-token-sanitization-logic-of-keycloak-an)
- [Keycloak Dynamic Client Registration privilege escalation](https://junglewise.ai/threats/cve-2026-96547-a-flaw-was-found-in-the-dynamic-client-registration-component-of)