EUVD-2026-41557
GHSA-5qq8-h7qh-phfj
Severity by source
AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N
Network-accessible API with no user interaction, but PR:L is correct as a delegated admin session is required; impact is strictly limited to low confidentiality with no integrity or availability effect.
Primary rating from Vendor (redhat).
CVSS VectorNVD
Lifecycle Timeline
3DescriptionNVD
A flaw was found in the Fine-Grained Admin Permissions (FGAP) v2 implementation within Keycloak's administrative services. When FGAP v2 is enabled, the system fails to properly filter child groups based on the caller's specific permissions when requested through a parent group. This allows a delegated administrator to view details of child groups they are not authorized to access directly, including group names, paths, and custom attributes.
AnalysisAI
Unauthorized child group disclosure in Red Hat Build of Keycloak's Fine-Grained Admin Permissions v2 (FGAP v2) exposes group names, paths, and custom attributes to delegated administrators who lack direct authorization over those child groups. When FGAP v2 is enabled and a delegated admin queries child groups through a parent group endpoint, the system omits the required per-permission filter, returning records that should be outside the caller's scope. No public exploit code has been identified and this vulnerability is not listed in the CISA KEV catalog, placing it in the category of a low-severity information disclosure risk that is nonetheless significant in multi-tenant IAM environments where group attribute confidentiality matters.
Technical ContextAI
Keycloak's Fine-Grained Admin Permissions (FGAP) v2 is an advanced authorization model that allows realm administrators to delegate specific management tasks - including group management - to sub-administrators with restricted scopes. The affected product is the Red Hat Build of Keycloak (CPE: cpe:2.3:a:red_hat:red_hat_build_of_keycloak:*:*:*:*:*:*:*:*), which is Red Hat's supported, productized distribution of the upstream Keycloak project. The root cause is classified as CWE-1220 (Insufficient Granularity of Access Control): the administrative services layer that handles group hierarchy traversal does not enforce caller-specific permission boundaries when resolving child groups under a parent, meaning the permission check occurs at the wrong level of abstraction (parent) rather than at each individual child resource. This is a server-side authorization bypass in the REST API layer rather than a client-side or protocol-level flaw.
RemediationAI
No specific patched release version has been confirmed in the available intelligence data - the CPE entry spans all versions without an explicit fix version boundary, and no vendor advisory citing an exact corrective release was identified. Organizations should monitor the Red Hat security advisory at https://access.redhat.com/security/cve/CVE-2026-14615 and apply the patch once released. As a compensating control, if FGAP v2 is not strictly required, disabling Fine-Grained Admin Permissions v2 in the realm configuration eliminates the vulnerable code path entirely; note that this trade-off removes the ability to delegate scoped admin roles and may require reverting to broader admin assignments. If FGAP v2 must remain enabled, restrict delegated administrator accounts to the minimum set of trusted personnel, reducing the pool of principals who could exploit the unauthorized enumeration path. Auditing group custom attributes for sensitive data and removing such data from group-level storage until the patch is applied is an additional low-disruption measure.
More in Red Hat Build Of Keycloak
View allAccount takeover in Red Hat Build of Keycloak allows an unauthenticated attacker to abuse the reset-credentials flow in
Account takeover in Keycloak (Red Hat build of Keycloak, Red Hat Single Sign-On 7) arises because the IdP-initiated SAML
Authentication bypass in Red Hat Build of Keycloak (and Red Hat Single Sign-On 7) lets an unauthenticated attacker forge
Privilege escalation in Red Hat Build of Keycloak's Dynamic Client Registration (DCR) grants an attacker with low-privil
Authorization bypass in the Keycloak Policy Enforcer allows any authenticated user to circumvent all enforced access con
URI normalization bypass in Keycloak's Authorization Services PathMatcher allows authenticated low-privilege users to re
Privilege escalation in Keycloak's Dynamic Client Registration (DCR) component allows attackers with standard user accou
Token exchange in Keycloak bypasses Google Workspace domain allowlist restrictions, enabling any valid Google account ho
Signature-verification bypass in Keycloak (and Red Hat's Keycloak-based products such as Red Hat Single Sign-On 7 and Re
Tenant-restriction bypass in Keycloak's Microsoft identity provider integration allows attackers holding any valid Micro
Session hijacking via SAML assertion replay in Keycloak's SAML broker component allows adjacent-network attackers to aut
Open redirect in Red Hat build of Keycloak permits remote attackers to send victims to attacker-controlled hosts by abus
Same technique Information Disclosure
View allVendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today