CVE-2026-7500: Org.keycloak.keycloak-services: improper access control on keycloak server when the account account api feature is disabled
When Keycloak is started with --features-disabled=account,account-api, the Account REST API is only partially disabled. Five endpoints under the versioned path /account/v1alpha1 remain fully functional — including both read and write operations — because they lack the checkAccountApiEnabled() gate that correctly blocks four other endpoints in the same REST service class. The user needs to have permissions to use the API.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Ensure Keycloak is started with the intended feature gate disabling both 'account' and 'account-api' (i.e., include both in --features-disabled) so the Account REST API does not remain partially functional at /account/v1alpha1.
Keycloak --features-disabled = account,account-api
Event History
Frequently Asked Questions
What is the severity of CVE-2026-7500?
CVE-2026-7500 has a medium severity rating due to improper access control impacting Keycloak servers.
How do I fix CVE-2026-7500?
To fix CVE-2026-7500, ensure proper configuration of Keycloak by correctly enabling or disabling the account and account API features.
What systems are affected by CVE-2026-7500?
CVE-2026-7500 affects Keycloak servers running the org.keycloak:keycloak-services library, particularly when the account-api feature is partially disabled.
What is the impact of CVE-2026-7500?
The impact of CVE-2026-7500 allows unauthorized access to certain endpoints of the Account REST API even when the account features are disabled.
Is there a workaround for CVE-2026-7500?
A workaround for CVE-2026-7500 includes monitoring and controlling access to the specific endpoints of the Account REST API.