mediumCVSS 5.4Vulnerability
CVE-2026-7500
When Keycloak is started with `--features-disabled=account,account-api`, the Account REST API is only partially disabled. Five endpoints under the versioned path `/account/v1alpha1` remain fully functional — including both read and write operations — because they lack the `checkAccountApiEnabled()` gate that correctly blocks four other endpoints in the same REST service class. The user needs to have permissions to use the API.
Properties
- summary
- Keycloak has a Forced Browsing issue
- severity
- medium
- epss_score
- 0.00232
- cvss_score
- 5.4
- ghsa_published
- 2026-04-30T15:30:39Z
- source_url
- https://github.com/advisories/GHSA-hm32-hfmw-rhvg
- ghsa_updated
- 2026-05-07T00:07:17Z
- ghsa_id
- GHSA-hm32-hfmw-rhvg
- cve_id
- CVE-2026-7500
- cvss_vector
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
- signal_observed_at
- 2026-09-11T17:55:57+00:00
- is_ghsa_only
- false
- epss_percentile
- 0.14396
Related Entities (5)
ENRICHED_BY (1)
→[Source]FIRST EPSS
REPORTED_BY (1)
→[Source]GitHub Advisory Database
VULNERABLE_TO (1)
←[Software]maven/org.keycloak:keycloak-services
AFFECTS (1)
→[Software]maven/org.keycloak:keycloak-services
HAS_WEAKNESS (1)
→[Weakness]Direct Request ('Forced Browsing')
Explore deeper with Ninja Signal's threat intelligence graph