Описание
A flaw was found in the Keycloak Admin REST API. This vulnerability allows the exposure of backend schema and rules, potentially leading to targeted attacks or privilege escalation via improper access control.
Отчет
Red Hat rates this as Low because the vulnerability allows a low-privileged user with 'create-client' permission to access internal user profile schema data, which is considered information disclosure. While this exposure of backend schema and rules could potentially be leveraged for targeted attacks or privilege escalation, it does not directly lead to immediate compromise of user accounts or system integrity.
Меры по смягчению последствий
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
Дополнительная информация
Статус:
EPSS
2.7 Low
CVSS3
Связанные уязвимости
A flaw was found in the Keycloak Admin REST API. This vulnerability allows the exposure of backend schema and rules, potentially leading to targeted attacks or privilege escalation via improper access control.
A flaw was found in the Keycloak Admin REST API. This vulnerability al ...
Keycloak Admin REST API exposes backend schema and rules
ALT-PU-2026-6040: package `keycloak` update to version 26.5.7-alt1
ALT-PU-2026-5671: package `keycloak` update to version 26.5.7-alt1
EPSS
2.7 Low
CVSS3