Bug 2464126 (CVE-2026-7500) - CVE-2026-7500 org.keycloak.keycloak-services: Improper Access Control on Keycloak Server when the account Account API feature is disabled
Summary: CVE-2026-7500 org.keycloak.keycloak-services: Improper Access Control on Keyc...
Keywords:
Status: NEW
Alias: CVE-2026-7500
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Product Security
QA Contact:
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2026-04-30 14:32 UTC by OSIDB Bzimport
Modified: 2026-04-30 14:43 UTC (History)
11 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Embargoed:

Attachments (Terms of Use)

Description OSIDB Bzimport 2026-04-30 14:32:21 UTC 
When Keycloak is started with `--features-disabled=account,account-api`, the Account REST API is only partially disabled. Five endpoints under the versioned path `/account/v1alpha1` remain fully functional — including both read and write operations — because they lack the `checkAccountApiEnabled()` gate that correctly blocks four other endpoints in the same REST service class. The user needs to have permissions to use the API.
Note You need to log in before you can comment on or make changes to this bug.