Aller au contenu
en Se connecter
4.3 Moyenne

CVE-2026-14613 A vulnerability was discovered in Keycloak's administrative interface that allows certain administrators to see…

Description

A vulnerability was discovered in Keycloak's administrative interface that allows certain administrators to see information about groups they shouldn't have access to. When the new Fine-Grained Admin Permissions (FGAP v2) are turned on, an administrator who is allowed to see a specific "role" can also see a list of all groups assigned to that role. The system fails to check if the administrator has permission to see those specific groups. This could allow a restricted administrator to discover "hidden" groups and see their details, such as internal names and custom settings, which might contain sensitive deployment information.

Produits et versions touchés

Produit Versions touchées Corrigé en
Red Hat Build of Keycloak Versions non publiées
Red Hat Data Grid 8 Versions non publiées
Red Hat JBoss Enterprise Application Platform Expansion Pack Versions non publiées
Red Hat Single Sign-On 7 Versions non publiées
Red Hat build of Keycloak 26.6 26.6 premières → < 26.6-12 26.6-12
Red Hat build of Keycloak 26.6.6 Versions non publiées

Références

Chronologie

  1. Publiée
  2. Dernière modification

Autres CVE de Red Hat Build of Keycloak

Les 266 CVE de Red Hat Build of Keycloak →
CVE-2026-97847 Keycloak-services: keycloak-services: client manager can substitute sessionless token principal via hardcoded-claim mappers to obtain realm administrator authority 7.1 Élevée CVE-2026-97175 Keycloak-services: keycloak-services: unverified idp email auto-linking enables account takeover 8.8 Élevée CVE-2026-97174 Keycloak-services: keycloak-services: ciba sub parameter injection causes attacker authentication to issue victim tokens 6.8 Moyenne CVE-2026-96453 Org.keycloak/keycloak-admin-cli: keycloak-admin-cli: kcadm custom truststore accepts arbitrary self-signed certificates 8.0 Élevée
Suivre cette CVE