CVE-2026-15945
published 2026-07-16CVE-2026-15945: A flaw was found in the group search functionality of the Keycloak server's administrative API. When Fine-Grained Admin Permissions (FGAP) v2 is enabled, a…
PriorityP413low2.7CVSS 3.1
AVNACLPRHUINSUCLINAN
EPSS
0.35%
27.2th percentile
A flaw was found in the group search functionality of the Keycloak server's administrative API. When Fine-Grained Admin Permissions (FGAP) v2 is enabled, a delegated administrator can bypass access restrictions to view parent groups they are not authorized to see. By searching for a child group they have permission to view, the system incorrectly returns the full details of the parent group in the response, leading to the disclosure of sensitive group attributes and configuration.
Affected
4 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| redhat | data_grid | — | — |
| redhat | single_sign-on | — | — |
| rhbk-keycloak-rhel9 | rhbk-keycloak-rhel9 | — | — |
| rhbk-openshift-rhel9 | rhbk-openshift-rhel9 | — | — |
CVSS provenance
nvdv3.12.7LOWCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N
vendor_redhat4.3MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
keycloak-services: keycloak-services: Group hierarchy search discloses hidden parent groups under FGAP v2
vendor_redhat·2026-07-14·CVSS 4.3
CVE-2026-15945 [MEDIUM] CWE-639 keycloak-services: keycloak-services: Group hierarchy search discloses hidden parent groups under FGAP v2
keycloak-services: keycloak-services: Group hierarchy search discloses hidden parent groups under FGAP v2
A flaw was found in the group search functionality of the Keycloak server's administrative API. When Fine-Grained Admin Permissions (FGAP) v2 is enabled, a delegated administrator can bypass access restrictions to view parent groups they are not authorized to see. By searching for a child group they have permission to view, the system incorrectly returns the full details of the parent group in the response, leading to the disclosure of sensitive group attributes and configuration.
Statement: The Red Hat Product Security team has assessed the severity of this vulnerability as Moderate, given that it requires an authenticated attacker with specific delegated administrative permissions
GHSA
A flaw was found in the group search functionality of the Keycloak server's administrative API.
ghsa_unreviewed·2026-07-16
CVE-2026-15945 [MEDIUM] CWE-639 A flaw was found in the group search functionality of the Keycloak server's administrative API.
A flaw was found in the group search functionality of the Keycloak server's administrative API. When Fine-Grained Admin Permissions (FGAP) v2 is enabled, a delegated administrator can bypass access restrictions to view parent groups they are not authorized to see. By searching for a child group they have permission to view, the system incorrectly returns the full details of the parent group in the response, leading to the disclosure of sensitive group attributes and configuration.
VulDB
Red Hat Keycloak Group Search access control (EUVD-2026-44990)
vuldb·2026-07-16·CVSS 4.3
CVE-2026-15945 [MEDIUM] Red Hat Keycloak Group Search access control (EUVD-2026-44990)
A vulnerability was found in Red Hat Keycloak and classified as problematic. Affected by this issue is some unknown functionality of the component Group Search. Executing a manipulation can lead to improper access controls.
This vulnerability is registered as CVE-2026-15945. It is possible to launch the attack remotely. No exploit is available.
No detection rules found.
No public exploits indexed.
2026-07-16
Published