MEDIUM 6.6 NVD

CVE-2026-97177

A flaw was found in the user update mechanism of the Keycloak Admin REST API. When Fine-Grained Admin Permissions are enabled, the system fails to check for spe

A flaw was found in the user update mechanism of the Keycloak Admin REST API. When Fine-Grained Admin Permissions are enabled, the system fails to check for specific password reset authorizations during a general user profile update. This allows a delegated administrator, who should be restricted from resetting passwords, to change a user's credentials and take over their account.

References

https://access.redhat.com/security/cve/CVE-2026-97177
https://bugzilla.redhat.com/show_bug.cgi?id=2539965

Published: 2026-09-24 · Source: NVD · Feed updated: 2026-09-24

This medium severity vulnerability with a CVSS score of 6.6 was published on 2026-09-24 via NVD.

vulnfeed aggregates 11940 vulnerabilities from NVD, CISA KEV, Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.