Red Hat Keycloak EUVD-2026-41557

Fine-Grained Admin Permissions v2 (FGAP v2) must be explicitly enabled in the Keycloak realm - this is a non-default feature that requires deliberate administrative activation. The exploiting principal must hold a valid delegated administrator credential with at least view-level permission on a parent group (CVSS PR:L confirms authentication is required). The flaw is triggered specifically via the parent group child-listing API endpoint; direct queries to individual child group endpoints may still enforce correct permission filtering. Exploitation is limited to reading group metadata (names, paths, custom attributes) - there is no write, delete, or privilege escalation component. Environments running Keycloak without FGAP v2 enabled, or those with no delegated administrator accounts, are not exposed.

The CVSS 3.1 base score of 4.3 (Medium) is driven by the vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N, indicating network-reachable exploitation with low complexity, but requiring an authenticated low-privileged user (a delegated administrator account). The impact is strictly limited to confidentiality (C:L) with no integrity or availability consequence. No EPSS score was provided in the intelligence data, so exploitation probability cannot be quantified. The vulnerability is not listed in the CISA KEV catalog and no public proof-of-concept code has been identified, both of which suppress the realistic short-term exploitation risk. The primary real-world concern is in multi-tenant or large enterprise deployments of Keycloak where delegated admins are isolated from each other and group attributes carry sensitive metadata (e.g., organizational structure, role hints in custom attributes). In environments not using FGAP v2, this vulnerability is not exploitable. Overall, this is a genuine but narrow-scope, low-urgency finding that warrants patching in affected configurations but does not represent an immediate critical priority.

An attacker holding a delegated administrator account in a Keycloak realm - one explicitly scoped to manage only a subset of groups - authenticates to the Keycloak Admin REST API and issues a GET request for child groups under a parent group they are permitted to see. Because FGAP v2 fails to apply per-child permission filtering in this code path, the response includes child groups outside the delegated admin's authorized scope, revealing their names, hierarchical paths, and any custom attributes stored at the group level. No exploit code is required beyond standard HTTP API calls, making this trivially executable by any delegated admin who is aware of the flaw.