CVE-2026-16072: Keycloak-services: keycloak-services: organization invitation link exposure allows unauthorized member creation

A permission bypass vulnerability was identified in the Keycloak organization REST API. The flaw exists in how pending organization invitations are handled. A user granted the manage-organizations permission, but lacking the manage-users permission, can initiate an invitation for an arbitrary email address. The API response for listing pending invitations includes the inviteLink, which contains a bearer token for registration. An attacker can retrieve this link and access it directly to register a new managed member. This bypasses the requirement for the manage-users permission and skips the intended email ownership verification step. Successful exploitation allows a delegated administrator to create new managed user accounts and associate them with an organization without proper authorization.

— Red Hat