When Keycloak is started with `--features-disabled=account,account-api`, the Account REST API is only partially disabled. Five endpoints under the versioned path `/account/v1alpha1` remain fully functional — including both read and write operations — because they lack the `checkAccountApiEnabled()` gate that correctly blocks four other endpoints in the same REST service class. The user needs to have permissions to use the API.
References
Configurations
History
10 Jun 2026, 22:17
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
10 Jun 2026, 18:17
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
05 May 2026, 03:00
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:a:redhat:build_of_keycloak:-:*:*:*:-:*:*:* | |
| First Time |
Redhat
Redhat build Of Keycloak |
|
| CWE | NVD-CWE-noinfo | |
| References | () https://access.redhat.com/security/cve/CVE-2026-7500 - Vendor Advisory | |
| References | () https://bugzilla.redhat.com/show_bug.cgi?id=2464126 - Issue Tracking |
30 Apr 2026, 15:48
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2026-04-30 15:16
Updated : 2026-06-10 22:17
NVD link : CVE-2026-7500
Mitre link : CVE-2026-7500
CVE.ORG link : CVE-2026-7500
JSON object : View
Products Affected
redhat
- build_of_keycloak
CWE