[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fxdABNjSRWAI26XP1GT_ig179xWwnA9yc57C361sULA8":3,"g5a-risk:CVE-2026-7500":108},{"success":4,"data":5,"meta":105},true,{"cveId":6,"title":7,"description":8,"shortDescription":9,"publishedDate":10,"lastModified":11,"cvssScore":12,"cvssVector":13,"cvssMetrics":14,"epssScore":31,"epssPercentile":26,"epssTimeSeries":32,"severity":33,"affectedProducts":34,"affectedProductsCount":40,"references":41,"referencesCount":51,"weaknesses":52,"weaknessesCount":40,"isActivelyExploited":61,"cisaInfo":26,"otxData":26,"relatedBlogPosts":62,"seoMetadata":63,"configurations":88,"relatedVendorCves":96,"notableEvents":97},"CVE-2026-7500","What is CVE-2026-7500?","When Keycloak is started with `--features-disabled=account,account-api`, the Account REST API is only partially disabled. Five endpoints under the versioned path `\u002Faccount\u002Fv1alpha1` remain fully functional — including both read and write operations — because they lack the `checkAccountApiEnabled()` gate that correctly blocks four other endpoints in the same REST service class. The user needs to have permissions to use the API.","When Keycloak is started with `--features-disabled=account,account-api`, the Account REST API is only partially disabled. Five endpoints under the versioned ...","2026-04-30T15:16:23.673","2026-05-05T03:00:08.177",5.4,"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:L\u002FUI:N\u002FS:U\u002FC:L\u002FI:L\u002FA:N",{"CVSSMetricV31":15,"CVSSMetricV30":29,"CVSSMetricV2":30,"CVSSMetricV40":26},[16],{"Source":17,"Type":18,"CVSSData":19,"ExploitabilityScore":27,"ImpactScore":28},"secalert@redhat.com","Primary",{"Version":20,"VectorString":13,"AttackVector":21,"AttackComplexity":22,"PrivilegesRequired":22,"UserInteraction":23,"Scope":24,"ConfidentialityImpact":22,"IntegrityImpact":22,"AvailabilityImpact":23,"BaseScore":12,"BaseSeverity":25,"ExploitCodeMaturity":26,"RemediationLevel":26,"ReportConfidence":26,"TemporalScore":26,"TemporalSeverity":26,"ConfidentialityRequirement":26,"IntegrityRequirement":26,"AvailabilityRequirement":26,"ModifiedAttackVector":26,"ModifiedAttackComplexity":26,"ModifiedPrivilegesRequired":26,"ModifiedUserInteraction":26,"ModifiedScope":26,"ModifiedConfidentialityImpact":26,"ModifiedIntegrityImpact":26,"ModifiedAvailabilityImpact":26,"EnvironmentalScore":26,"EnvironmentalSeverity":26},"3.1","NETWORK","LOW","NONE","UNCHANGED","MEDIUM",null,2.8,2.5,[],[],0.00232,[31,31,31,31,31,31,31],"Medium",[35],{"vendor":36,"product":37,"version":38,"criteria":39,"vulnerable":4},"redhat","build_of_keycloak","-","cpe:2.3:a:redhat:build_of_keycloak:-:*:*:*:-:*:*:*",1,[42,47],{"url":43,"source":44,"tags":45},"https:\u002F\u002Faccess.redhat.com\u002Fsecurity\u002Fcve\u002FCVE-2026-7500","Red Hat",[46],"Vendor Advisory",{"url":48,"source":44,"tags":49},"https:\u002F\u002Fbugzilla.redhat.com\u002Fshow_bug.cgi?id=2464126",[50],"Issue Tracking",2,[53],{"id":54,"name":55,"description":56,"extendedDescription":57,"status":58,"abstraction":59,"structure":60},"CWE-425","Direct Request ('Forced Browsing')","The web application does not adequately enforce appropriate authorization on all restricted URLs, scripts, or files.","Web applications susceptible to direct request attacks often make the false assumption that such resources can only be reached through a given navigation path and so only apply authorization at certain points in the path.","Incomplete","Base","Simple",false,[],{"title":64,"metaDescription":65,"keywords":66,"canonicalUrl":67,"structuredData":68},"What is CVE-2026-7500? Vulnerability Analysis | Security Advisory | EdgeProtect","Comprehensive analysis of CVE-2026-7500, a medium severity cyber security vulnerability from 2026. When Keycloak is started with `--features-disabled=account...","CVE-2026-7500, CVE-2026-7500 vulnerability, CVE-2026-7500 security, medium severity vulnerability, cybersecurity, vulnerability analysis, security advisory, CVE database, threat intelligence, security research, vulnerability assessment, cyber threats, 2026, CVSS score, exploit, patch, remediation, redhat security, build_of_keycloak vulnerability","\u002Fwhat-is\u002Fcve-2026-7500",{"@context":69,"@type":70,"headline":64,"description":65,"datePublished":10,"dateModified":11,"author":71,"publisher":75,"about":79,"mainEntityOfPage":83,"articleSection":86,"keywords":87},"https:\u002F\u002Fschema.org","TechArticle",{"@type":72,"name":73,"url":74},"Organization","EdgeProtect","https:\u002F\u002Fedgeprotect.io",{"@type":72,"name":73,"url":74,"logo":76},{"@type":77,"url":78},"ImageObject","https:\u002F\u002Fedgeprotect.io\u002Fimg\u002Flogos\u002Fedgeprotect-logo-512.png",{"@type":80,"name":6,"description":81,"additionalType":82},"Thing","Cybersecurity Vulnerability","https:\u002F\u002Fschema.org\u002FSoftwareBug",{"@type":84,"@id":85},"WebPage","https:\u002F\u002Fedgeprotect.io\u002Fwhat-is\u002Fcve-2026-7500","Cybersecurity","CVE-2026-7500, CVE-2026-7500 vulnerability, CVE-2026-7500 security, medium severity vulnerability, cybersecurity, vulnerability analysis, security advisory, CVE database, threat intelligence, security research",[89],{"Operator":26,"Negate":26,"Nodes":90},[91],{"Operator":92,"Negate":61,"CPEMatch":93},"OR",[94],{"Vulnerable":4,"Criteria":39,"MatchCriteriaID":95,"VersionStartExcluding":26,"VersionStartIncluding":26,"VersionEndExcluding":26,"VersionEndIncluding":26},"E5C930CB-4EAD-497B-A44B-D880F2A1F85B",[],[98],{"id":99,"eventType":100,"eventTime":101,"details":102,"label":103,"color":104},"ff709e1c-4123-4f43-917b-d8bf58e7d7cf","NEW_NVD","2026-05-05T18:24:38.367426+00:00","New CVE added to NVD","Published to NVD","blue",{"lastModified":11,"cacheTime":106,"version":107},1793202566260,"2.0",{"score":109,"band":110,"action":111,"scoredAt":112},21,"Low","Monitor","2026-07-01T10:39:51.127717+00:00"]