Red Hat Keycloak EUVD-2026-40299

Exploitation requires two explicit prerequisites: (1) Fine-Grained Admin Permissions v2 (FGAPv2) must be deliberately enabled in the target Keycloak realm - this is a non-default advanced configuration that must be activated by a realm administrator; (2) the attacker must possess a valid Keycloak administrative account that has been delegated at least user-search scope in that realm. Limiting factors that constrain exposure include: the attacker must be authenticated (CVSS PR:L), must have prior administrative access provisioned within Keycloak, and the vulnerable condition only arises when FGAPv2 is active and permission delegation is configured with narrower-than-view grants. Deployments that do not use FGAPv2, or where all admins already hold full view permissions, are not exposed to the permission-bypass outcome. The impact is confidentiality-only (I:N, A:N), restricting the attacker to read access on user profile data rather than modification or service disruption.

The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) yields a score of 4.3, correctly reflecting a network-reachable, low-complexity flaw requiring only low-level privilege and producing partial confidentiality loss. Real-world risk is bounded in two important ways: first, exploitation requires FGAPv2 to be explicitly enabled - a non-default feature that must be deliberately activated; second, the attacker must already possess a valid Keycloak admin credential with at least search-scoped permissions. This is an insider-threat or privilege-escalation vector within the administrative tier, not a perimeter breach. No EPSS score was provided in the source data, and this CVE is not listed in the CISA KEV catalog, meaning no confirmed active exploitation is known. The missing integrity and availability impact (I:N, A:N) confirms this is purely an information disclosure issue. Despite the low CVSS score, the disclosed data - full user profiles and security metadata - could enable follow-on attacks such as account enumeration, targeted social engineering, or understanding lockout states for specific accounts. Organizations running Keycloak with FGAPv2-based delegation models (common in multi-tenant or managed-service scenarios) should treat this as a meaningful lateral-access risk within the admin plane, even if perimeter exposure is low.

A helpdesk administrator granted search-only permissions in a Keycloak realm with FGAPv2 enabled sends a crafted HTTP GET request to the Admin REST 'brute-force-user' endpoint, supplying a target user's ID. Because the endpoint omits the view-permission check present on other paths, Keycloak returns the target user's full profile - including account status, security metadata, and personal attributes - without verifying that the caller holds view rights. No public exploit code has been identified at time of analysis, but the attack requires only standard HTTP tooling and a valid low-privilege admin token.