EUVD-2026-41555
GHSA-j2vp-w8g9-p6hf
Severity by source
AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
Network-accessible admin API requires authenticated low-privilege admin; only group metadata disclosed, no integrity or availability impact.
Primary rating from Vendor (redhat).
CVSS VectorNVD
Lifecycle Timeline
2DescriptionNVD
A vulnerability was discovered in Keycloak's administrative interface that allows certain administrators to see information about groups they shouldn't have access to. When the new Fine-Grained Admin Permissions (FGAP v2) are turned on, an administrator who is allowed to see a specific "role" can also see a list of all groups assigned to that role. The system fails to check if the administrator has permission to see those specific groups. This could allow a restricted administrator to discover "hidden" groups and see their details, such as internal names and custom settings, which might contain sensitive deployment information.
AnalysisAI
Keycloak's Fine-Grained Admin Permissions v2 (FGAP v2) fails to enforce group-level authorization when a restricted administrator queries role-to-group assignments, exposing group names and custom attributes beyond the admin's intended scope. Restricted admins holding only role-view permission can enumerate all groups assigned to that role, bypassing the group-level access controls that FGAP v2 is designed to enforce. No public exploit code exists and this vulnerability has not been added to the CISA KEV catalog; however, the EPSS risk is compounded in deployments where group attributes carry sensitive operational metadata.
Technical ContextAI
Keycloak is Red Hat's enterprise identity and access management platform, providing single sign-on and federated identity services across Red Hat Single Sign-On 7, Red Hat Build of Keycloak, Red Hat JBoss EAP Expansion Pack, and Red Hat Data Grid 8. FGAP v2 is a feature designed to enforce granular delegation - allowing tenant administrators to manage only specific realms, roles, or groups rather than the entire Keycloak instance. The vulnerability is a missing authorization check in the code path that resolves group membership for a given role. While CWE is unassigned by the reporter, the root cause class is Improper Authorization (CWE-285): the system correctly validates that the caller can view the role, but omits a secondary check to confirm the caller holds group-view permission for each group returned in that role's member list. This is an authorization logic gap in the FGAP v2 permission intersection model, not a bypass of the authentication layer itself.
RemediationAI
The primary remediation is to apply the patch released by Red Hat, available via the Red Hat Security Advisory at https://access.redhat.com/security/cve/CVE-2026-14613. No exact fixed version number was included in the available input data; security teams should consult the advisory directly to identify the target package version for their specific product (Red Hat Build of Keycloak, RH-SSO 7, Data Grid 8, or JBoss EAP Expansion Pack). As an interim compensating control prior to patching, organizations should disable FGAP v2 if it is not actively required, which eliminates the vulnerable code path entirely at the cost of reverting to coarser-grained admin delegation. If FGAP v2 cannot be disabled, audit all delegated admin accounts to ensure that only trusted administrators hold role-view permissions, and review group attributes to ensure that sensitive deployment metadata is not stored directly in Keycloak group properties. The trade-off of disabling FGAP v2 is loss of granular delegation capability, which may affect multi-tenant or MSP-style deployments. No patch version is independently confirmed from the available input data.
More in Red Hat Build Of Keycloak
View allAccount takeover in Red Hat Build of Keycloak allows an unauthenticated attacker to abuse the reset-credentials flow in
Account takeover in Keycloak (Red Hat build of Keycloak, Red Hat Single Sign-On 7) arises because the IdP-initiated SAML
Authentication bypass in Red Hat Build of Keycloak (and Red Hat Single Sign-On 7) lets an unauthenticated attacker forge
Privilege escalation in Red Hat Build of Keycloak's Dynamic Client Registration (DCR) grants an attacker with low-privil
Authorization bypass in the Keycloak Policy Enforcer allows any authenticated user to circumvent all enforced access con
URI normalization bypass in Keycloak's Authorization Services PathMatcher allows authenticated low-privilege users to re
Privilege escalation in Keycloak's Dynamic Client Registration (DCR) component allows attackers with standard user accou
Token exchange in Keycloak bypasses Google Workspace domain allowlist restrictions, enabling any valid Google account ho
Signature-verification bypass in Keycloak (and Red Hat's Keycloak-based products such as Red Hat Single Sign-On 7 and Re
Tenant-restriction bypass in Keycloak's Microsoft identity provider integration allows attackers holding any valid Micro
Session hijacking via SAML assertion replay in Keycloak's SAML broker component allows adjacent-network attackers to aut
Open redirect in Red Hat build of Keycloak permits remote attackers to send victims to attacker-controlled hosts by abus
Same weakness CWE-284 – Improper Access Control
View allSame technique Authentication Bypass
View allVendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today