Executive brief
Keycloak, a popular identity and access management solution, contains a flaw where organization-related data can be leaked even after an administrator has disabled the 'Organizations' feature. An authenticated user who was previously a member of an organization can still retrieve organization metadata through account APIs or by requesting specific security tokens. This could lead to downstream applications making incorrect security decisions based on outdated or disabled organizational memberships.
Technical details
An incorrect authorization flaw (CWE-863) exists in Keycloak's organization management component. While disabling the 'Organizations' feature correctly blocks the administrative API, it fails to restrict user-facing endpoints. Specifically, the account API (GET /realms/{realm}/account/organizations) and OIDC token requests using the 'organization' scope continue to return membership data for previously enrolled users. This occurs even when 'organizationsEnabled' is set to false at the realm level. Attackers require existing organization membership and valid authentication to exploit this. The issue is resolved in Keycloak version 26.6.3 and corresponding Red Hat builds.
Affected products
- Keycloak Keycloak >= 26.5.0, < 26.6.3
- Keycloak Keycloak <= 26.4.7
- Red Hat Red Hat build of Keycloak 26.6 < 26.6.3-3
- Red Hat Red Hat build of Keycloak 26.4 < 26.4.13-1
Timeline
- 2026-05-28: disclosed: Initial disclosure and NVD publication
- 2026-06-10: patched: Red Hat released security advisory RHSA-2026:25098 for Keycloak 26.6.3