{"affected":[{"defaultStatus":"unaffected","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"keycloak-services","product":"Red Hat build of Keycloak 26.6.8","source":"CNA: redhat","vendor":"Red Hat","versions":[]},{"defaultStatus":"unaffected","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"rhbk/keycloak-rhel9","product":"Red Hat build of Keycloak 26.6.8","source":"CNA: redhat","vendor":"Red Hat","versions":[]},{"defaultStatus":"unaffected","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"keycloak-services","product":"Red Hat Single Sign-On 7","source":"CNA: redhat","vendor":"Red Hat","versions":[]}],"cveId":"CVE-2026-97177","cwes":["CWE-862"],"description":"A flaw was found in the user update mechanism of the Keycloak Admin REST API. When Fine-Grained Admin Permissions are enabled, the system fails to check for specific password reset authorizations during a general user profile update. This allows a delegated administrator, who should be restricted from resetting passwords, to change a user's credentials and take over their account.","epss":{"date":"2026-11-05","percentile":0.14803,"score":0.00237},"exploits":[],"kev":null,"metrics":[{"score":6.6,"severity":"medium","source":"CNA: redhat","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},{"score":6.6,"severity":"medium","source":"NVD: secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H","version":"3.1"}],"modifiedAt":1793963843683,"publishedAt":1790228877900,"references":[{"source":"CNA: redhat","tags":["vendor-advisory","x_refsource_REDHAT"],"url":"https://access.redhat.com/errata/RHSA-2026:95761"},{"source":"CNA: redhat","tags":["vdb-entry","x_refsource_REDHAT"],"url":"https://access.redhat.com/security/cve/CVE-2026-97177"},{"source":"CNA: redhat","tags":["issue-tracking","x_refsource_REDHAT"],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2539965"},{"source":"secalert@redhat.com","tags":[],"url":"https://access.redhat.com/errata/RHSA-2026:95761"},{"source":"secalert@redhat.com","tags":[],"url":"https://access.redhat.com/security/cve/CVE-2026-97177"},{"source":"secalert@redhat.com","tags":[],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2539965"}],"remediation":[{"kind":"workaround","source":"CNA: redhat","text":"Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."}],"revision":"e15ddaabe4ba562c773c8c69c96a769069b4f2394c9ef9918a3b18a051f750de","sources":[{"modifiedAt":1793960857025,"name":"CNA: redhat","retrievedAt":1793963492794,"url":"https://www.cve.org/CVERecord?id=CVE-2026-97177"},{"modifiedAt":1793963843683,"name":"NVD","retrievedAt":1793967461315,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-97177"},{"modifiedAt":null,"name":"FIRST EPSS","retrievedAt":1793963498197,"url":"https://api.first.org/data/v1/epss?cve=CVE-2026-97177"}],"ssvc":{"assessedAt":1790254654967,"automatable":"no","exploitation":"none","source":"ADP: CISA-ADP","technicalImpact":"total"},"status":"published","title":"Keycloak-services: keycloak-services: generic user update bypasses denied reset-password permission","updatedAt":1793967461315}