CVE-2020-14389: Red Hat Keycloak

High severity, CVSS 8.1. EPSS: 0.8% chance of exploitation in the next 30 days.

It was found that Keycloak before version 12.0.0 would permit a user with only view-profile role to manage the resources in the new account console, allowing access and modification of data the user was not intended to have.

Affected products

• Red Hat Keycloak: before 12.0.0 (fixed in 12.0.0)

Published 2020-11-17. Last modified 2026-06-17.