CVE-2026-116470

{}

{}

{}

{"acknowledgement": "Red Hat would like to thank Takashi Mima (task4233) for reporting this issue.", "bugzilla": {"description": "keycloak-services: keycloak-services: SCIM user listing endpoint returns full PII without per-user VIEW authorization check", "id": "2560583", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2560583"}, "csaw": false, "cvss3": {"cvss3_base_score": "4.4", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N", "status": "draft"}, "cwe": "CWE-862", "details": ["A flaw was found in the SCIM user listing endpoint of Keycloak, an open-source identity and access management solution. The issue occurs because the endpoint fails to perform per-user VIEW authorization checks when returning user lists. This allows a service account or user with limited query permissions to retrieve full personally identifiable information (PII), such as names and email addresses, for all non-admin users in a realm. This could lead to unauthorized data exposure in environments where the SCIM API is enabled."], "mitigation": {"lang": "en:us", "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."}, "name": "CVE-2026-116470", "package_state": [{"cpe": "cpe:/a:redhat:build_keycloak:", "fix_state": "Not affected", "package_name": "keycloak-services", "product_name": "Red Hat Build of Keycloak"}, {"cpe": "cpe:/a:redhat:build_keycloak:", "fix_state": "Not affected", "package_name": "rhbk/keycloak-rhel9", "product_name": "Red Hat Build of Keycloak"}, {"cpe": "cpe:/a:redhat:red_hat_single_sign_on:7", "fix_state": "Not affected", "package_name": "keycloak-services", "product_name": "Red Hat Single Sign-On 7"}], "public_date": "2026-10-23T19:35:06Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-116470\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-116470"], "statement": "The Red Hat Product Security team has assessed the severity of this vulnerability as Moderate, given that it requires specific non-default configurations and high-privileged access to exploit. Successful exploitation allows an attacker to retrieve full PII for all non-admin users in a realm. The vulnerability's root cause is a regression in the authorization logic of the SCIM user listing endpoint.", "threat_severity": "Moderate"}

{"created": "2026-10-26T13:30:08.851324+00:00", "updated": "2026-10-26T13:30:08.851337+00:00", "vendors": []}