CVE-2026-97311 Keycloak-services: keycloak-services: admin rest api role-groups endpoint discloses groups without authorization

Description

A flaw was found in the Admin REST API of Keycloak, an identity and access management solution. The endpoints used to retrieve groups associated with a specific role do not properly check for individual group visibility permissions. This allows a delegated administrator with basic search privileges to view detailed information about all groups assigned to a role, bypassing intended security restrictions that should limit their view to specific groups.

Exploitable remotely over the network, with an ordinary account and without any user action; the impact on data or service is limited.

Attack vector

Network

Attack complexity

Low

Privileges required

Low

Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Affected products and versions