CVE-2026-0871: Org.keycloak/keycloak-services: keycloak: unauthorized modification of unmanaged user attributes by administrators
A flaw was found in Keycloak. An administrator with manage-users permission can bypass the "Only administrators can view" setting for unmanaged attributes, allowing them to modify these attributes. This improper access control can lead to unauthorized changes to user profiles, even when the system is configured to restrict such modifications.
Other sources
Summary
When the Unmanaged Attributes is set to Only administrators can view, the administrator that has manage-users permission can anyway edit the unmanaged attributes. For example using curl or kcsdm.sh:
./kcadm.sh update users/b0df9d35-3319-4e87-81ea-9a906372fa1f -r sample -s "attributes.lala=lala"
Requirements to exploit
The realm should be configured unmanaged attributes to Only administrators can view and the admin should have permissions to edit users.
Component affected:
org.keycloak:keycloak-services Version affected: <26.4.0
Patch available: no
CVSS: (Based on
https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator
) Initially i would say medium:
Vector:
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N Base Score: 4.9 (Medium)
Embargo: no, if you consider it's moderate too.
Acknowledgement
Steps to reproduce
Create a new realm and configure in realm settings -> Genaral tab -> unmanaged attributes to Only administrators can view.
Use kcadm (for example to edit the user with an admin that has manage-users permission using the presented command.
The user is updated and toy can see the new attribute in the console.
The operation should an error or attributes skipped.
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-0871?
CVE-2026-0871 is considered a critical vulnerability due to its potential for unauthorized modifications of unmanaged user attributes by administrators.
How do I fix CVE-2026-0871?
To fix CVE-2026-0871, upgrade to Keycloak version 26.5.2 or later.
Who is affected by CVE-2026-0871?
CVE-2026-0871 affects Keycloak versions up to 26.4.0 including specific builds by Red Hat.
What causes CVE-2026-0871?
CVE-2026-0871 is caused by insufficient restrictions on administrator permissions regarding unmanaged user attributes.
Can CVE-2026-0871 lead to data breaches?
Yes, CVE-2026-0871 can lead to data breaches due to unauthorized access to sensitive user attributes by administrators.