CVE-2026-97177

A flaw was found in the user update mechanism of the Keycloak Admin REST API. When Fine-Grained Admin Permissions are enabled, the system fails to check for specific password reset authorizations during a general user profile update. This allows a delegated administrator, who should be restricted from resetting passwords, to change a user's credentials and take over their account.

• CWE-862

• https://access.redhat.com/security/cve/CVE-2026-97177
• https://bugzilla.redhat.com/show_bug.cgi?id=2539965

Published

Sep 24, 2026

Last Modified

Sep 24, 2026

Status

Awaiting Analysis

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-97152Nanomsg versions 0.5-beta through 1.x before 1.2.3 has a rem…8.6
• CVE-2026-97155Fabasoft Folio Client before 2026, a locally installed compo…6.5
• CVE-2026-9716CWE-476 NULL Pointer Dereference vulnerability exists that c…7.5
• CVE-2026-97168Rejected reason: it is a suggestion
• CVE-2026-9717CWE-78 Neutralization of Special Elements used in an OS Comm…7.2
• CVE-2026-97176A flaw was found in the Level of Authentication enforcement …4.2
• CVE-2026-97179A security vulnerability has been detected in O2OA up to 9.5…4.3
• CVE-2026-9718CWE-617 Reachable Assertion vulnerability exists that could …6.5
• CVE-2026-97181GPM LIGHT developed by ezGlobal has a Sensitive Data Exposur…5.3
• CVE-2026-97182A security vulnerability has been detected in halo-dev Halo …7.3
• CVE-2026-97185A flaw was found in GIMP. When processing a specially crafte…7.8
• CVE-2026-9719The LatePoint – Calendar Booking Plugin for Appointments and…4.3