Analyst readout for executives and security teams
Plain-English summary
This flaw can keep organization information visible to logged-in users even after administrators disable Keycloak's Organizations feature. The main business risk is not broad system compromise; it is stale organization metadata appearing in APIs or tokens and causing downstream applications to make authorization decisions on data administrators expected to be disabled.
Executive priority
Prioritize this for identity environments where Keycloak organization data drives access decisions. It is not described as actively exploited or high impact, but identity authorization mistakes can affect sensitive business workflows if downstream services trust stale metadata.
Technical view
In affected Red Hat build of Keycloak 26.6 packages, an authenticated user with existing organization membership may receive organization metadata through user-facing APIs or OIDC tokens using the organization scope after Organizations is disabled. Red Hat rates this CVSS 4.3, with low confidentiality impact and no integrity or availability impact in the CVSS vector.
Likely exposure
Exposure is limited to affected Red Hat build of Keycloak 26.6 on RHEL 9, including listed keycloak-rhel9, keycloak-rhel9-operator, and operator bundle packages. Higher concern exists where applications trust organization token claims or account API organization data for access control.
Exploitation context
The source bundle does not show KEV listing or active exploitation evidence. Exploitation requires a valid authenticated user who already has organization membership. The issue is most relevant where resource servers consume organization metadata for authorization after administrators believe the Organizations feature is disabled.
Researcher notes
This is an authorization-control weakness mapped to CWE-863, but the disclosed impact is confidentiality of organization metadata and possible incorrect downstream authorization. The bundle does not provide detailed fixed package names beyond an unaffected Red Hat build of Keycloak 26.6.3 and Red Hat advisory references.
Mitigation direction
- Check RHSA-2026:25097 and RHSA-2026:25098 for fixed builds and deployment instructions.
- Upgrade affected Red Hat build of Keycloak 26.6 packages where vendor guidance applies.
- Treat Red Hat build of Keycloak 26.6.3 as unaffected only as stated by the source bundle.
- Review downstream authorization logic that trusts organization metadata in tokens or account APIs.
- Temporarily avoid authorization decisions based only on organization claims from affected deployments.
Validation and detection
- Inventory Keycloak deployments for the affected Red Hat build and package versions listed in the source bundle.
- Confirm whether the Organizations feature was used and later disabled in affected realms.
- Review resource servers for authorization paths that consume organization claims or account API organization data.
- In an authorized test environment, verify whether organization metadata still appears after disabling the feature.
- Confirm remediation by retesting token and account API metadata behavior after vendor updates.
Public sources used
Based on public source material and reviewed before publication.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-863: Authorization and privilege behavior lookup
Authorization weaknesses can support privilege escalation and valid-account review, depending on exploit path. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCredential and access behavior lookup
The CVE wording references authentication or credential exposure, so valid-account and credential-access review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCVE-2026-9791 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 4.3 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N 2.8 1.4 redhat Vulnerability scoring details
Base CVSS 3.1 score
4.3 MediumVector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- Source timeline redhat
Reported to Red Hat.
- CVE reserved CVE Program
The CVE ID was reserved by the assigning CNA.
- Source timeline redhat
Made public.
- CVE published CVE Program
The CVE record was published.
- CVE updated CVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 source CVE List V5
- RHSA-2026:25097 CVE reference, redhat · vendor-advisory, x_refsource_REDHAT
- RHSA-2026:25098 CVE reference, redhat · vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/security/cve/CVE-2026-9791 CVE reference, redhat · vdb-entry, x_refsource_REDHAT
- RHBZ#2482458 CVE reference, redhat · issue-tracking, x_refsource_REDHAT
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Incorrect Authorization
Incorrect Authorization represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.