4.3
Moyenne
CVE-2026-14615 A flaw was found in the Fine-Grained Admin Permissions (FGAP) v2 implementation within Keycloak's administrative…
Description
A flaw was found in the Fine-Grained Admin Permissions (FGAP) v2 implementation within Keycloak's administrative services. When FGAP v2 is enabled, the system fails to properly filter child groups based on the caller's specific permissions when requested through a parent group. This allows a delegated administrator to view details of child groups they are not authorized to access directly, including group names, paths, and custom attributes.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| Red Hat Build of Keycloak | Versions non publiées | |
| Red Hat build of Keycloak 26.4 26.4 | premières → < 26.4-22 | 26.4-22 |
| Red Hat build of Keycloak 26.4.14 | Versions non publiées | |
| Red Hat build of Keycloak 26.6 26.6 | premières → < 26.6-11 | 26.6-11 |
| Red Hat build of Keycloak 26.6.5 | Versions non publiées |
Références
- RHSA-2026:50846 access.redhat.com
- RHSA-2026:50847 access.redhat.com
- RHSA-2026:50848 access.redhat.com
- RHSA-2026:50849 access.redhat.com
- access.redhat.com access.redhat.com
- RHBZ#2496891 bugzilla.redhat.com
Chronologie
- Publiée
- Dernière modification
Autres CVE de Red Hat Build of Keycloak
Les 266 CVE de Red Hat Build of Keycloak →
CVE-2026-97847
Keycloak-services: keycloak-services: client manager can substitute sessionless token principal via hardcoded-claim mappers to obtain realm administrator authority
7.1
Élevée
CVE-2026-97175
Keycloak-services: keycloak-services: unverified idp email auto-linking enables account takeover
8.8
Élevée
CVE-2026-97174
Keycloak-services: keycloak-services: ciba sub parameter injection causes attacker authentication to issue victim tokens
6.8
Moyenne
CVE-2026-96453
Org.keycloak/keycloak-admin-cli: keycloak-admin-cli: kcadm custom truststore accepts arbitrary self-signed certificates
8.0
Élevée