{"id":"CVE-2024-3656","state":"PUBLISHED","title":"Keycloak: unguarded admin rest api endpoints allows low privilege users to use administrative functionalities","description":"A flaw was found in Keycloak. Certain endpoints in Keycloak's admin REST API allow low-privilege users to access administrative functionalities. This flaw allows users to perform actions reserved for administrators, potentially leading to data breaches or system compromise.","publishedAt":"2024-10-09T18:59:11.101Z","updatedAt":"2026-10-09T15:35:14.704Z","severity":{"score":8.1,"label":"High","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","source":"redhat"},"assigner":"redhat","products":["keycloak","Red Hat Red Hat Build of Keycloak","Red Hat Red Hat Single Sign-On 7","Red Hat Red Hat JBoss Enterprise Application Platform 8"],"affected":[{"packageName":"keycloak","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"24.0.5","versionType":"semver"}],"collectionURL":"https://github.com/keycloak/keycloak"},{"vendor":"Red Hat","product":"Red Hat Build of Keycloak","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:build_keycloak:24"]},{"vendor":"Red Hat","product":"Red Hat Single Sign-On 7","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:red_hat_single_sign_on:7.6"]},{"vendor":"Red Hat","product":"Red Hat Build of Keycloak","packageName":"org.keycloak-keycloak-parent","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:build_keycloak:"]},{"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 8","packageName":"org.keycloak-keycloak-parent","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/jbossnetwork/restricted/listSoftware.html","cpes":["cpe:/a:redhat:jboss_enterprise_application_platform:8"]},{"vendor":"Red Hat","product":"Red Hat Single Sign-On 7","packageName":"org.keycloak-keycloak-parent","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:red_hat_single_sign_on:7"]}],"references":["https://access.redhat.com/errata/RHSA-2024:3572","https://access.redhat.com/errata/RHSA-2024:3575","https://access.redhat.com/security/cve/CVE-2024-3656","https://bugzilla.redhat.com/show_bug.cgi?id=2274403","https://github.com/advisories/GHSA-2cww-fgmg-4jqc","https://security.humanativaspa.it/an-analysis-of-the-keycloak-authentication-system/","https://news.ycombinator.com/item?id=42136000","https://github.com/hnsecurity/vulns/blob/main/HNS-2024-08-Keycloak.md"],"weaknesses":["CWE-200"],"ingestedAt":"2026-10-29T20:07:39.287Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2024/3xxx/CVE-2024-3656.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2024-3656","state":"PUBLISHED","datePublished":"2024-10-09T18:59:11.101Z","dateUpdated":"2026-10-09T15:35:14.704Z","assignerShortName":"redhat","assignerOrgId":"53f830b8-0a3f-465b-8143-3b8a9948e749","dateReserved":"2024-04-11T13:57:15.173Z"},"containers":{"cna":{"title":"Keycloak: unguarded admin rest api endpoints allows low privilege users to use administrative functionalities","descriptions":[{"lang":"en","value":"A flaw was found in Keycloak. Certain endpoints in Keycloak's admin REST API allow low-privilege users to access administrative functionalities. This flaw allows users to perform actions reserved for administrators, potentially leading to data breaches or system compromise."}],"affected":[{"packageName":"keycloak","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"24.0.5","versionType":"semver"}],"collectionURL":"https://github.com/keycloak/keycloak"},{"vendor":"Red Hat","product":"Red Hat Build of Keycloak","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:build_keycloak:24"]},{"vendor":"Red Hat","product":"Red Hat Single Sign-On 7","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:red_hat_single_sign_on:7.6"]},{"vendor":"Red Hat","product":"Red Hat Build of Keycloak","packageName":"org.keycloak-keycloak-parent","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:build_keycloak:"]},{"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 8","packageName":"org.keycloak-keycloak-parent","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/jbossnetwork/restricted/listSoftware.html","cpes":["cpe:/a:redhat:jboss_enterprise_application_platform:8"]},{"vendor":"Red Hat","product":"Red Hat Single Sign-On 7","packageName":"org.keycloak-keycloak-parent","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:red_hat_single_sign_on:7"]}],"references":[{"url":"https://access.redhat.com/errata/RHSA-2024:3572","name":"RHSA-2024:3572","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2024:3575","name":"RHSA-2024:3575","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-3656","tags":["vdb-entry","x_refsource_REDHAT"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2274403","name":"RHBZ#2274403","tags":["issue-tracking","x_refsource_REDHAT"]},{"url":"https://github.com/advisories/GHSA-2cww-fgmg-4jqc"}],"metrics":[{"other":{"content":{"value":"Important","namespace":"https://access.redhat.com/security/updates/classification/"},"type":"Red Hat severity rating"}},{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":8.1,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","version":"3.1"},"format":"CVSS"}],"problemTypes":[{"descriptions":[{"cweId":"CWE-200","description":"Exposure of Sensitive Information to an Unauthorized Actor","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"redhat","orgId":"53f830b8-0a3f-465b-8143-3b8a9948e749","dateUpdated":"2026-10-09T15:35:14.704Z"},"datePublic":"2024-10-09T18:11:00.000Z","x_redhatCweChain":"CWE-200: Exposure of Sensitive Information to an Unauthorized Actor","workarounds":[{"lang":"en","value":"Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability."}],"timeline":[{"lang":"en","time":"2024-04-09T00:00:00.000Z","value":"Reported to Red Hat."},{"lang":"en","time":"2024-10-09T18:11:00.000Z","value":"Made public."}],"credits":[{"lang":"en","value":"Red Hat would like to thank Maurizio Agazzini for reporting this issue. Upstream acknowledges the Keycloak project as the original reporter."}],"x_generator":{"engine":"cvelib 1.8.0"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2024-10-09T19:18:03.646470Z","id":"CVE-2024-3656","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2024-10-09T19:18:12.613Z"}},{"title":"CVE Program Container","references":[{"url":"https://security.humanativaspa.it/an-analysis-of-the-keycloak-authentication-system/"},{"url":"https://news.ycombinator.com/item?id=42136000"},{"url":"https://github.com/hnsecurity/vulns/blob/main/HNS-2024-08-Keycloak.md"}],"providerMetadata":{"shortName":"CVE","orgId":"af854a3a-2127-422b-91ae-364da2661108","dateUpdated":"2024-11-14T16:58:52.300Z"},"x_generator":{"engine":"ADPogram 0.0.1"}}]}}}