CVE-2026-7500
When Keycloak is started with , the Account REST API is only partially disabled.
Published Apr 30, 2026 · updated Jun 26, 2026 · redhat build of keycloak
When Keycloak is started with , the Account REST API is only partially disabled. Five endpoints under the versioned path remain fully functional — including both read and write operations — because they lack the gate that correctly blocks four other endpoints in the same REST service class. The user needs to have permissions to use the API.
Code
The project this record applies to. Exploit listings stay in References.
No public source repository is identified for this product.
Timeline
Detection, updates, and resolution for this record.
Apr 30, 2026 · NIST NVD
Detected
When Keycloak is started with , the Account REST API is only partially disabled. Five endpoints under the versioned path remain fully functional — including both read and write operations — because they lack the gate that correctly blocks four other endpoints in the same REST service class. The user needs to have permissions to use the API.
Jun 26, 2026 · NIST NVD
Updated
When Keycloak is started with , the Account REST API is only partially disabled. Five endpoints under the versioned path remain fully functional — including both read and write operations — because they lack the gate that correctly blocks four other endpoints in the same REST service class. The user needs to have permissions to use the API.
Affected
- cpe redhat/build of keycloakversion unspecified
Sources
- CVE.orgVulnerability recordCVE-2026-7500
Official CVE identifier
cve.org - NIST NVDVulnerability recordCVE-2026-7500
When Keycloak is started with , the Account REST API is only partially disabled. Five endpoints under the versioned path remain fully functional — including both read and write operations — because they lack the `checkA
nvd.nist.gov