Nixpkgs security tracker
Untriaged
Permalink
CVE-2025-13881
2.7 LOW
- CVSS version: 3.1
- Attack vector (AV): NETWORK
- Attack complexity (AC): LOW
- Privileges required (PR): HIGH
- User interaction (UI): NONE
- Scope (S): UNCHANGED
- Confidentiality impact (C): LOW
- Integrity impact (I): NONE
- Availability impact (A): NONE
Org.keycloak.services.resources.admin: keycloak: limited administrator can retrieve sensitive user attributes via admin api
A flaw was found in Keycloak Admin API. This vulnerability allows an administrator with limited privileges to retrieve sensitive custom attributes via the /unmanagedAttributes endpoint, bypassing User Profile visibility settings.
References
Affected products
keycloak
rhbk/keycloak-rhel9
- *
rhbk/keycloak-rhel9-operator
- *
rhbk/keycloak-operator-bundle
- *
Matching in nixpkgs
pkgs.keycloak
Identity and access management for modern applications and services
pkgs.terraform-providers.keycloak
None
-
nixos-unstable 5.4.0
pkgs.python312Packages.python-keycloak
Provides access to the Keycloak API
-
nixos-unstable 4.0.0
pkgs.python313Packages.python-keycloak
Provides access to the Keycloak API
pkgs.python314Packages.python-keycloak
Provides access to the Keycloak API
pkgs.terraform-providers.keycloak_keycloak
None
Package maintainers
-
@leona-ya Leona Maroni <nix@leona.is>
-
@ngerstle Nicholas Gerstle <ngerstle@gmail.com>
-
@talyz Kim Lindberger <kim.lindberger@gmail.com>
-
@NickCao Nick Cao <nickcao@nichi.co>