CVE-2026-0871
CWE-266Published: February 27, 2026· Updated: Mar 5, 2026
Official Description
A flaw was found in Keycloak. An administrator with `manage-users` permission can bypass the "Only administrators can view" setting for unmanaged attributes, allowing them to modify these attributes. This improper access control can lead to unauthorized changes to user profiles, even when the system is configured to restrict such modifications.
Technical Analysis
CVE-2026-0871 can be exploited remotely over the network without requiring physical or adjacent access, significantly expanding the attack surface for threat actors.
Exploitation requires high privileges, which limits the exposure to scenarios where an attacker has already gained initial access.
A successful exploit results in full integrity compromise (data manipulation), with a CVSS base score of 4.9.
CVSS v3.1 Vector Breakdown
Affected Vendors & Products
Exploit & PoC Resources
Official Patches & Advisories
All References (4)
Quick Facts
Related CVEs (CWE-266)
Recommended Actions
- →Apply vendor patches immediately
- →Monitor CVE-2026-0871 in threat intel feeds
- →Review IDS/IPS signatures for exploitation attempts