CVE-2026-9791: Red Hat Keycloak Incorrect Authorization in Organizations Feature

CVE-2026-9791 · Severity: medium · CVSS 4.3 · Published 2026-05-28

Keycloak, a popular identity and access management solution, contains a flaw where organization-related data can be leaked even after an administrator has disabled the 'Organizations' feature. An authenticated user who was previously a member of an organization can still retrieve organization metadata through account APIs or by requesting specific security tokens. This could lead to downstream applications making incorrect security decisions based on outdated or disabled organizational memberships.

Technologies: Keycloak, org.keycloak:keycloak-server-spi-private (Maven), org.keycloak:keycloak-services (Maven), Red Hat build of Keycloak 26.4. Vendors: Keycloak, Maven, Red Hat.

Quick answers

Is CVE-2026-9791 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-9791 being exploited in the wild.
How severe is CVE-2026-9791?
Medium severity, with a CVSS score of 4.3, published 28 May 2026.
Which products and versions are affected?
Keycloak >= 26.5.0, < 26.6.3; org.keycloak:keycloak-server-spi-private (Maven) ECOSYSTEM:introduced=26.5.0,fixed=26.6.3; org.keycloak:keycloak-services (Maven) ECOSYSTEM:introduced=26.5.0,fixed=26.6.3; Red Hat build of Keycloak 26.4 < 26.4.13-1; and 1 more.
Is there a fix for CVE-2026-9791?
Yes. org.keycloak:keycloak-server-spi-private (Maven): upgrade to 26.6.3 or later; org.keycloak:keycloak-services (Maven): upgrade to 26.6.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-9791 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-9791?
Check whether you run Keycloak, org.keycloak:keycloak-server-spi-private (Maven), org.keycloak:keycloak-services (Maven) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • org.keycloak:keycloak-server-spi-private (Maven): upgrade to 26.6.3 or later
    # set org.keycloak:keycloak-server-spi-private to 26.6.3 in your pom.xml or build.gradle
  • org.keycloak:keycloak-services (Maven): upgrade to 26.6.3 or later
    # set org.keycloak:keycloak-services to 26.6.3 in your pom.xml or build.gradle

Technical details

An incorrect authorization flaw (CWE-863) exists in Keycloak's organization management component. While disabling the 'Organizations' feature correctly blocks the administrative API, it fails to restrict user-facing endpoints. Specifically, the account API (GET /realms/{realm}/account/organizations) and OIDC token requests using the 'organization' scope continue to return membership data for previously enrolled users. This occurs even when 'organizationsEnabled' is set to false at the realm level. Attackers require existing organization membership and valid authentication to exploit this. The issue is resolved in Keycloak version 26.6.3 and corresponding Red Hat builds.

Affected products

  • Keycloak Keycloak >= 26.5.0, < 26.6.3
  • Keycloak Keycloak <= 26.4.7
  • Red Hat Red Hat build of Keycloak 26.6 < 26.6.3-3
  • Red Hat Red Hat build of Keycloak 26.4 < 26.4.13-1

Identifiers

  • CVE-2026-9791
  • GHSA-4q93-v92x-p89f

Timeline

  • 2026-05-28: disclosed: Initial disclosure and NVD publication
  • 2026-06-10: patched: Red Hat released security advisory RHSA-2026:25098 for Keycloak 26.6.3

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.