Untriaged
by @jopejoe1 Activity log
- Created automatic suggestion
-
@jopejoe1
removed
5 packages
- terraform-providers.keycloak
- python312Packages.python-keycloak
- python313Packages.python-keycloak
- python314Packages.python-keycloak
- terraform-providers.keycloak_keycloak
Org.keycloak.services.resources.admin: keycloak: limited administrator can retrieve sensitive user attributes via admin api
A flaw was found in Keycloak Admin API. This vulnerability allows an administrator with limited privileges to retrieve sensitive custom attributes via the /unmanagedAttributes endpoint, bypassing User Profile visibility settings.
Affected products
keycloak
rhbk/keycloak-rhel9
- *
rhbk/keycloak-rhel9-operator
- *
rhbk/keycloak-operator-bundle
- *
Package maintainers
-
@leona-ya Leona Maroni <nix@leona.is>
-
@NickCao Nick Cao <nickcao@nichi.co>
-
@ngerstle Nicholas Gerstle <ngerstle@gmail.com>
-
@talyz Kim Lindberger <kim.lindberger@gmail.com>