CVE-2026-14615
MEDIUMKeycloak-services: keycloak: fgap v2 parent group children endpoint bypasses per-child view permission filter
Title source: cnaDescription
A flaw was found in the Fine-Grained Admin Permissions (FGAP) v2 implementation within Keycloak's administrative services. When FGAP v2 is enabled, the system fails to properly filter child groups based on the caller's specific permissions when requested through a parent group. This allows a delegated administrator to view details of child groups they are not authorized to access directly, including group names, paths, and custom attributes.
References (2)
Core 2
Core References
Vdb Entry, X_Refsource_Redhat vdb-entry
x_refsource_redhat
https://access.redhat.com/security/cve/CVE-2026-14615
Issue Tracking, X_Refsource_Redhat issue-tracking
x_refsource_redhat
RHBZ#2496891
https://bugzilla.redhat.com/show_bug.cgi?id=2496891
Scores
CVSS v3
4.3
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Details
CWE
CWE-1220
Status
published
Products (1)
Red Hat/Red Hat Build of Keycloak
Published
Jul 03, 2026
Tracked Since
Jul 03, 2026