Red Hat Keycloak CVE-2026-14613

FGAP v2 (Fine-Grained Admin Permissions version 2) must be explicitly enabled in the Keycloak realm - this is a non-default, opt-in feature. The attacker must hold a valid, authenticated Keycloak administrator account with at least role-view permission granted under the FGAP v2 model. Exploitation is not possible against standard Keycloak deployments where FGAP v2 is disabled, nor against environments where all admin accounts hold full (non-restricted) administrative scope. The CVSS PR:L metric confirms authentication as a restricted admin is required; unauthenticated exploitation is not possible. Exploitation is limited to read-only group metadata disclosure - no write, delete, or privilege escalation capability is exposed through this flaw. The impacted information is group names and custom attributes, which may or may not carry operationally sensitive content depending on how the organization uses group attributes.

The CVSS 3.1 base score of 4.3 (Medium) reflects a network-accessible, low-privilege, no-interaction flaw with limited confidentiality impact and no integrity or availability exposure - an accurate characterization for an information-disclosure-only finding. The S:U (Unchanged scope) metric confirms no lateral privilege escalation is possible through this bug alone; it is a reconnaissance aid, not an exploitation primitive. No EPSS data was provided, and the vulnerability is absent from CISA KEV, indicating no confirmed active exploitation. The real-world risk is further constrained by the requirement for FGAP v2 to be explicitly enabled - a non-default, opt-in feature not present in standard Keycloak deployments. The primary threat model is insider or delegated-admin abuse: an attacker who already holds a restricted admin credential could map hidden group topology and harvest group attribute data (e.g., environment names, integration endpoints, tenant tags). That reconnaissance value may enable privilege escalation through social engineering or inform follow-on attacks, but the vulnerability does not itself grant access beyond metadata. No CVSS or exploitation signal conflicts exist in the available data.

An attacker who has obtained a restricted Keycloak administrator credential - one scoped only to role-view permissions within FGAP v2 - sends a query to the Keycloak admin REST API requesting the group membership list for a role they are authorized to view. The response returns all groups assigned to that role without a secondary group-view authorization check, exposing group names, descriptions, and custom attributes. The attacker uses this information to map the hidden group topology of the realm, potentially discovering environment-specific group names, integration identifiers, or deployment annotations stored as group attributes that were intended to be invisible to restricted admins.