---
cve: "CVE-2026-2366"
severity: "LOW"
cvss: 3.1
epss: "27%"
vendor: "Red Hat"
kev: false
exploited: false
published: "2026-03-12 10:54:31"
tags: [cve, security, low]
source: tsecurity.de CVE-Dossier
exported: "2026-09-19T03:32:59+02:00"
---

# CVE-2026-2366

> 3.1 LOW

## Beschreibung

A flaw was found in Keycloak. An authorization bypass vulnerability in the Keycloak Admin API allows any authenticated user, even those without administrative privileges, to enumerate the organization memberships of other users. This information disclosure occurs if the attacker knows the victim's unique identifier (UUID) and the Organizations feature is enabled.

## CVSS-Vektor

```
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N
```

| Metrik | Wert | Bewertung |
|---|---|---|
| AV Angriffsvektor | Netzwerk | bad |
| AC Komplexität | Hoch | good |
| PR Privilegien | Gering | warn |
| UI Interaktion | Keine | bad |
| S Scope | Unverändert | good |
| C Vertraulichkeit | Gering | warn |
| I Integrität | Keine | good |
| A Verfügbarkeit | Keine | good |

## Referenzen

- <https://access.redhat.com/errata/RHSA-2026:6477>
- <https://access.redhat.com/errata/RHSA-2026:6478>
- <https://access.redhat.com/security/cve/CVE-2026-2366>
- <https://bugzilla.redhat.com/show_bug.cgi?id=2439081>

---
_Exportiert aus dem [tsecurity.de CVE-Dossier](https://tsecurity.de/cve?cve=CVE-2026-2366) · Datenquellen: EUVD (ENISA), NVD, OSV, CISA KEV, FIRST EPSS, Exploit-DB, BSI BITS_