{
  "threat_severity" : "Moderate",
  "public_date" : "2026-04-30T00:00:00Z",
  "bugzilla" : {
    "description" : "org.keycloak.keycloak-services: Improper Access Control on Keycloak Server when the account Account API feature is disabled",
    "id" : "2464126",
    "url" : "https://bugzilla.redhat.com/show_bug.cgi?id=2464126"
  },
  "cvss3" : {
    "cvss3_base_score" : "5.4",
    "cvss3_scoring_vector" : "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
    "status" : "verified"
  },
  "cwe" : "CWE-425",
  "details" : [ "When Keycloak is started with `--features-disabled=account,account-api`, the Account REST API is only partially disabled. Five endpoints under the versioned path `/account/v1alpha1` remain fully functional — including both read and write operations — because they lack the `checkAccountApiEnabled()` gate that correctly blocks four other endpoints in the same REST service class. The user needs to have permissions to use the API.", "When Keycloak is started with `--features-disabled=account,account-api`, the Account REST API is only partially disabled. Five endpoints under the versioned path `/account/v1alpha1` remain fully functional — including both read and write operations — because they lack the `checkAccountApiEnabled()` gate that correctly blocks four other endpoints in the same REST service class. The user needs to have permissions to use the API." ],
  "statement" : "This Moderate impact flaw in Keycloak allows authenticated users to bypass the intended disablement of the account and account-api features when Keycloak is started with `--features-disabled=account,account-api`. This bypass enables unauthorized read and write operations on specific account endpoints, despite the configuration aiming to restrict such access.",
  "acknowledgement" : "Red Hat would like to thank Evan Hendra for reporting this issue.",
  "affected_release" : [ {
    "product_name" : "Red Hat build of Keycloak 26.4",
    "release_date" : "2026-06-25T00:00:00Z",
    "advisory" : "RHSA-2026:30050",
    "cpe" : "cpe:/a:redhat:build_keycloak:26.4::el9",
    "package" : "rhbk/keycloak-operator-bundle:26.4.13-1"
  }, {
    "product_name" : "Red Hat build of Keycloak 26.4",
    "release_date" : "2026-06-25T00:00:00Z",
    "advisory" : "RHSA-2026:30050",
    "cpe" : "cpe:/a:redhat:build_keycloak:26.4::el9",
    "package" : "rhbk/keycloak-rhel9:26.4-19"
  }, {
    "product_name" : "Red Hat build of Keycloak 26.4",
    "release_date" : "2026-06-25T00:00:00Z",
    "advisory" : "RHSA-2026:30050",
    "cpe" : "cpe:/a:redhat:build_keycloak:26.4::el9",
    "package" : "rhbk/keycloak-rhel9-operator:26.4-19"
  }, {
    "product_name" : "Red Hat build of Keycloak 26.4.13",
    "release_date" : "2026-06-25T00:00:00Z",
    "advisory" : "RHSA-2026:30049",
    "cpe" : "cpe:/a:redhat:build_keycloak:26.4::el9",
    "package" : "rhbk/keycloak-rhel9"
  }, {
    "product_name" : "Red Hat build of Keycloak 26.6",
    "release_date" : "2026-06-10T00:00:00Z",
    "advisory" : "RHSA-2026:25097",
    "cpe" : "cpe:/a:redhat:build_keycloak:26.6::el9",
    "package" : "rhbk/keycloak-operator-bundle:26.6.3-3"
  }, {
    "product_name" : "Red Hat build of Keycloak 26.6",
    "release_date" : "2026-06-10T00:00:00Z",
    "advisory" : "RHSA-2026:25097",
    "cpe" : "cpe:/a:redhat:build_keycloak:26.6::el9",
    "package" : "rhbk/keycloak-rhel9:26.6-6"
  }, {
    "product_name" : "Red Hat build of Keycloak 26.6",
    "release_date" : "2026-06-10T00:00:00Z",
    "advisory" : "RHSA-2026:25097",
    "cpe" : "cpe:/a:redhat:build_keycloak:26.6::el9",
    "package" : "rhbk/keycloak-rhel9-operator:26.6-6"
  }, {
    "product_name" : "Red Hat build of Keycloak 26.6.3",
    "release_date" : "2026-06-10T00:00:00Z",
    "advisory" : "RHSA-2026:25098",
    "cpe" : "cpe:/a:redhat:build_keycloak:26.6::el9",
    "package" : "rhbk/keycloak-rhel9"
  } ],
  "references" : [ "https://www.cve.org/CVERecord?id=CVE-2026-7500\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-7500" ],
  "name" : "CVE-2026-7500",
  "mitigation" : {
    "value" : "To reduce the attack surface, restrict network access to the Keycloak server's administration and API endpoints to trusted networks or hosts. This limits the ability of unauthorized users to interact with the server and potentially exploit this improper access control vulnerability. If the Keycloak service is reloaded or restarted, ensure that firewall rules or network access controls remain in effect.",
    "lang" : "en:us"
  },
  "csaw" : false
}