CVE detail
CVE-2026-0871
A flaw was found in Keycloak. An administrator with `manage-users` permission can bypass the "Only administrators can view" setting for unmanaged attributes, allowing them to modify these attributes. This improper access control can lead to unauthorized changes to user profiles, even when the system is configured to restrict such modifications.
Buzz score
Why this CVE is surfacing
This all-time snapshot uses the same composite formula as Trending across a 30-year evidence window, rather than a current rolling window.
Buzz score components · mention 16.1 · diversity 10.0 · KEV 0.0 · OTX 0.0 · PoC 0.0
Why it matters now
Mention timeline
- Total mentions
- 0
- within the 30d window
- Peak daily
- 0
- highest bucket
Evidence
Source links by recency
4 source links · newest first
- https://bugzilla.redhat.com/show_bug.cgi?id=2428881bugzilla.redhat.com
No excerpt available.
Exploitbugzilla.redhat.comFeb 27, 2026, 8:17 AM - https://access.redhat.com/security/cve/CVE-2026-0871access.redhat.com
No excerpt available.
Vendor Advisoryaccess.redhat.comFeb 27, 2026, 8:17 AM - https://access.redhat.com/errata/RHSA-2026:2366access.redhat.com
No excerpt available.
Vendor Advisoryaccess.redhat.comFeb 27, 2026, 8:17 AM - https://access.redhat.com/errata/RHSA-2026:2365access.redhat.com
No excerpt available.
Vendor Advisoryaccess.redhat.comFeb 27, 2026, 8:17 AM
Exploit code
Public exploit repository references
Public PoC repositories are third-party, potentially unsafe artifacts. Treat their code as untrusted and use it only on authorized systems in an isolated, least-privilege environment. cvebuzz does not execute the code or verify that an exploit works.
0 repository references · best confidence N/A · max 0 stars
Related records
Similar CVEs
6 related CVEs with shared weakness or product evidence
- CVE-2026-4629CVSS 6.5 · Medium
A flaw was found in Keycloak. A highly privileged user with `manage-clients` permission can exploit this vulnerability by injecting a hardcoded role mapper into any client. This a…
- CVE-2026-12388CVSS 6.5 · Medium
A flaw was found in the Identity Provider (IdP) mapper component of Keycloak, which is used to manage how user information from external services is mapped to Keycloak users. An a…
- CVE-2026-9795CVSS 7.3 · High
A flaw was found in Keycloak's Fine-Grained Admin Permissions (FGAPv2) feature. An administrator with limited client management permissions can exploit this vulnerability to assig…
- CVE-2026-3121CVSS 6.5 · Medium
A flaw was found in Keycloak. An administrator with `manage-clients` permission can exploit a misconfiguration where this permission is equivalent to `manage-permissions`. This al…
- CVE-2026-3047CVSS 8.8 · High
A flaw was found in org.keycloak.broker.saml. When a disabled Security Assertion Markup Language (SAML) client is configured as an Identity Provider (IdP)-initiated broker landing…
- CVE-2025-12150CVSS 3.1 · Low
A flaw was found in Keycloak’s WebAuthn registration component. This vulnerability allows an attacker to bypass the configured attestation policy and register untrusted or forged…