VULNERABILITY INTELLIGENCE

CVE-2026-75005

CVSS score8.7 HIGH

EPSS probability0.23%

CISA KEVNot currently listed

Published2026-08-27

Last modified2026-08-28

Description

When Keycloak is started with `--features-disabled=account,account-api`, the Account REST API is only partially disabled. Five endpoints under the versioned path `/account/v1alpha1` remain fully functional — including both read and write operations — because they lack the `checkAccountApiEnabled()` gate that correctly blocks four other endpoints in the same REST service class. The user needs to have permissions to use the API.