Red Hat Keycloak CVE-2026-15945

Exploitation requires two specific, non-default conditions to be simultaneously true: (1) Fine-Grained Admin Permissions v2 (FGAP v2) must be explicitly enabled in the Keycloak realm - this feature is not enabled by default and requires deliberate administrator configuration; (2) the attacker must authenticate as or control a delegated administrator account that holds at least read permission on at least one child group within the affected hierarchy. Standard Keycloak deployments without FGAP v2 are entirely unaffected. Exploitation is limited to the confidentiality domain - no modification or denial-of-service impact is possible through this vector. The CVSS PR:L confirms authentication is required; unauthenticated exploitation is not possible. The flaw does not affect realm administrators with full privileges, only scoped delegated administrators whose access is intentionally restricted.

The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) scores 4.3 Medium, reflecting a low-privilege network-accessible read-only disclosure with no integrity or availability impact. Real-world risk is further bounded by two hard prerequisites: FGAP v2 must be explicitly enabled (not the default), and a delegated administrator account with child-group scope must exist or be compromised. Organizations that have not enabled FGAP v2 are entirely unaffected. No EPSS data was provided; without KEV listing and no known POC, probability of opportunistic exploitation is low. The risk profile is most relevant to multi-tenant enterprise deployments where Keycloak administers sensitive organizational hierarchies - leaked parent group attributes could expose organizational structure, LDAP mappings, or role configurations useful for privilege escalation planning. SSVC signals: exploitation status not active, not automatable at scale (requires valid delegated admin credentials), technical impact is partial. This is a real but lower-priority issue unless the affected organization relies heavily on delegated admin isolation as a security boundary.

An attacker who has compromised or is operating as a legitimate delegated administrator in a Keycloak realm with FGAP v2 enabled issues a group search API request scoped to a child group within their authorized scope. The API response returns the full details of the parent group - including attributes such as LDAP distinguished names, custom group attributes, and administrative configuration - which the delegated admin has no authorization to access. The attacker uses this leaked organizational and configuration data to map the identity hierarchy and inform further privilege escalation attempts. No public proof-of-concept exists at time of analysis, but the attack requires only standard HTTP API requests with valid delegated credentials.