CVE-2026-14615
published 2026-07-03CVE-2026-14615: A flaw was found in the Fine-Grained Admin Permissions (FGAP) v2 implementation within Keycloak's administrative services. When FGAP v2 is enabled, the system…
PriorityP413low2.7CVSS 3.1
AVNACLPRHUINSUCLINAN
EPSS
0.38%
30.6th percentile
A flaw was found in the Fine-Grained Admin Permissions (FGAP) v2 implementation within Keycloak's administrative services. When FGAP v2 is enabled, the system fails to properly filter child groups based on the caller's specific permissions when requested through a parent group. This allows a delegated administrator to view details of child groups they are not authorized to access directly, including group names, paths, and custom attributes.
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| redhat | build_of_keycloak | >= 26.4 < 26.4.14 | 26.4.14 |
| redhat | build_of_keycloak | >= 26.6 < 26.6.5 | 26.6.5 |
| rhbk | keycloak-rhel9 | — | — |
CVSS provenance
nvdv3.12.7LOWCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N
vendor_redhat4.3MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
A flaw was found in the Fine-Grained Admin Permissions (FGAP) v2 implementation within Keycloak's administrative services.
ghsa_unreviewed·2026-07-03
CVE-2026-14615 [MEDIUM] CWE-1220 A flaw was found in the Fine-Grained Admin Permissions (FGAP) v2 implementation within Keycloak's administrative services.
A flaw was found in the Fine-Grained Admin Permissions (FGAP) v2 implementation within Keycloak's administrative services. When FGAP v2 is enabled, the system fails to properly filter child groups based on the caller's specific permissions when requested through a parent group. This allows a delegated administrator to view details of child groups they are not authorized to access directly, including group names, paths, and custom attributes.
VulDB
Keycloak on Red Hat insufficient granularity of access control (EUVD-2026-41557)
vuldb·2026-07-03·CVSS 4.3
CVE-2026-14615 [MEDIUM] Keycloak on Red Hat insufficient granularity of access control (EUVD-2026-41557)
A vulnerability categorized as problematic has been discovered in Keycloak on Red Hat. This impacts an unknown function. Executing a manipulation can lead to insufficient granularity of access control.
This vulnerability is tracked as CVE-2026-14615. The attack can be launched remotely. No exploit exists.
Red Hat
keycloak-services: keycloak: FGAP v2 parent group children endpoint bypasses per-child view permission filter
vendor_redhat·2026-07-03·CVSS 4.3
CVE-2026-14615 [MEDIUM] CWE-1220 keycloak-services: keycloak: FGAP v2 parent group children endpoint bypasses per-child view permission filter
keycloak-services: keycloak: FGAP v2 parent group children endpoint bypasses per-child view permission filter
A flaw was found in the Fine-Grained Admin Permissions (FGAP) v2 implementation within Keycloak's administrative services. When FGAP v2 is enabled, the system fails to properly filter child groups based on the caller's specific permissions when requested through a parent group. This allows a delegated administrator to view details of child groups they are not authorized to access directly, including group names, paths, and custom attributes.
Statement: The Red Hat Product Security team has assessed the severity of this vulnerability as Moderate, given that it requires the attacker to possess a delegated administrator role with specific permissions. Successful exploitation allows
No detection rules found.
No public exploits indexed.
2026-07-03
Published