CVE-2026-14615CWE-1220

CVE-2026-14615

Medium · published July 3, 2026

CVSS v3.1
4.3
EPSS
0%
Percentile
30.6
In the wild
Unconfirmed
What it is

A flaw was found in the Fine-Grained Admin Permissions (FGAP) v2 implementation within Keycloak's administrative services. When FGAP v2 is enabled, the system fails to properly filter child groups based on the caller's specific permissions when requested through a parent group. This allows a delegated administrator to view details of child groups they are not authorized to access directly, including group names, paths, and custom attributes.

The record
Technical detail
CVSS v3.1
4.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00378 · 30.6th percentile
Weakness
CWE-1220 · Insufficient Granularity of Access Control
Published
2026-07-03T20:16Z
Affected products (2)
ProductVersionsFixed in
redhat/build_of_keycloak≥ 26.4, < 26.4.1426.4.14
redhat/build_of_keycloak≥ 26.6, < 26.6.526.6.5
References (6)
https://access.redhat.com/errata/RHSA-2026:50846 · [email protected]https://access.redhat.com/errata/RHSA-2026:50847 · [email protected]https://access.redhat.com/errata/RHSA-2026:50848 · [email protected]https://access.redhat.com/errata/RHSA-2026:50849 · [email protected]https://access.redhat.com/security/cve/CVE-2026-14615 · [email protected]https://bugzilla.redhat.com/show_bug.cgi?id=2496891 · [email protected]
EPSS history
Timeline
  • 03 JUL 15:47Z
    Keycloak-services: keycloak: fgap v2 parent group children endpoint bypasses per-child view permission filter
    cvelistv5