CVE-2026-7500

5.4 Moyenne

Publiée le 30/04/2026 à 17:16 · Modifiée le 26/06/2026 à 10:16 · Modifiée · Source : secalert@redhat.com

Description

When Keycloak is started with `--features-disabled=account,account-api`, the Account REST API is only partially disabled. Five endpoints under the versioned path `/account/v1alpha1` remain fully functional — including both read and write operations — because they lack the `checkAccountApiEnabled()` gate that correctly blocks four other endpoints in the same REST service class. The user needs to have permissions to use the API.

Traduire en français

Produits concernés

Red Hat build of Keycloak 26.4
Red Hat build of Keycloak 26.4.13
Red Hat build of Keycloak 26.6
Red Hat build of Keycloak 26.6.3
Redhat build of keycloak

Scores CVSS

Version	Score	Source	Vecteur
3.1	5.4 Moyenne	secalert@redhat.com	`CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N`

Faiblesses (CWE)

CWE-425

Références

https://access.redhat.com/errata/RHSA-2026:25097
https://access.redhat.com/errata/RHSA-2026:25098
https://access.redhat.com/errata/RHSA-2026:30049
https://access.redhat.com/errata/RHSA-2026:30050
https://access.redhat.com/security/cve/CVE-2026-7500 Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2464126 Issue Tracking

Ailleurs

NVD
CVE.org
CIRCL Vulnerability-Lookup
CERT-FR
GitHub Advisories