VULNERABILITY INTELLIGENCE

CVE-2026-18201

CVSS score5.5 MEDIUM
EPSS probability0.38%
CISA KEVNot currently listed
Published2026-07-29
Last modified2026-09-16
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:H/A:N

Description

Keycloak provides a way to manage identity providers and organizations through its administrative API. A flaw was discovered where an administrator with permission to manage identity providers could link a new provider to an organization without having the required permissions to manage that organization. This could allow an unauthorized administrator to influence how users log into specific organizations.

Weakness classification

  • secalert@redhat.com: CWE-862

Primary references