CVE-2026-14615
4.3
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Summary
A flaw was found in the Fine-Grained Admin Permissions (FGAP) v2 implementation within Keycloak's administrative services. When FGAP v2 is enabled, the system fails to properly filter child groups based on the caller's specific permissions when requested through a parent group. This allows a delegated administrator to view details of child groups they are not authorized to access directly, including group names, paths, and custom attributes.
Affected Software
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Red Hat | Red Hat build of Keycloak 26.4 | 26.4.14-1 < * | unaffected |
| Red Hat | Red Hat build of Keycloak 26.4 | 26.4-22 < * | unaffected |
| Red Hat | Red Hat build of Keycloak 26.4 | 26.4-22 < * | unaffected |
| Red Hat | Red Hat build of Keycloak 26.6 | 26.6.5-1 < * | unaffected |
| Red Hat | Red Hat build of Keycloak 26.6 | 26.6-11 < * | unaffected |
| Red Hat | Red Hat build of Keycloak 26.6 | 26.6-11 < * | unaffected |
Weaknesses
- CWE-1220: Insufficient Granularity of Access Control
ADP Enrichment
CISA ADP Vulnrichment
- SSVC:
- Exploitation: none
- Automatable: no
- Technical Impact: partial
References
- https://access.redhat.com/errata/RHSA-2026:50846
- https://access.redhat.com/errata/RHSA-2026:50847
- https://access.redhat.com/errata/RHSA-2026:50848
- https://access.redhat.com/errata/RHSA-2026:50849
- https://access.redhat.com/security/cve/CVE-2026-14615
- https://bugzilla.redhat.com/show_bug.cgi?id=2496891
Feedback
Was this page helpful?
Glad to hear it! Please tell us how we can improve.
Sorry to hear that. Please tell us how we can improve.