CVE-2026-14615 MEDIUM

CVE-2026-14615: Keycloak-services: keycloak: fgap v2 parent group children endpoint bypasses per-child view permission filter

Vendor Red Hat
Product Red Hat Build of Keycloak
Weakness CWE-1220
Published July 3, 2026
Last update July 13, 2026
View on NVD All CVEs

CVSS base score

4.3/10
Attack vector Network
Attack complexity Low
Privileges required Low
User interaction None
Confidentiality Low
Integrity None

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

What the vulnerability does

01Description

A flaw was found in the Fine-Grained Admin Permissions (FGAP) v2 implementation within Keycloak's administrative services. When FGAP v2 is enabled, the system fails to properly filter child groups based on the caller's specific permissions when requested through a parent group. This allows a delegated administrator to view details of child groups they are not authorized to access directly, including group names, paths, and custom attributes.

Key dates

02Disclosure timeline

July 3, 2026 CVE published
July 13, 2026 Record updated