Back to overview

CVE-2026-14209

MEDIUM
4.3
CVSS 3.1
Description
A vulnerability was discovered in Keycloak's Admin UI extension that allows certain administrative users to bypass security restrictions. When Fine-Grained Admin Permissions (FGAPv2) are enabled, an administrator who should only be able to search for users (but not view their full details) can use a specific "brute-force-user" endpoint to access a user's full profile. This includes sensitive information and security metadata. The issue occurs because the system fails to check if the administrator has the required "view" permission for that specific user when using this particular search path.

Metadata

CVE ID
CVE-2026-14209
State
PUBLISHED
Assigner
redhat
Reserved
2026-06-30 10:52 UTC
Published
2026-06-30 11:48 UTC
Last updated
2026-06-30 18:46 UTC
Primary CWE
CWE-639
Authorization Bypass Through User-Controlled Key
Vendor / Product
Red Hat / Red Hat Build of Keycloak
Sources
cve.org  ·  NVD

Severity & Metrics

4.3 MEDIUM CVSS 3.1
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
SSVC — CISA Coordinator
Exploitation
none
Automatable
no
Tech. Impact
partial
Affected products (4)
VendorProductPlatformVersions
Red Hat Red Hat Build of Keycloak — —
Red Hat Red Hat Build of Keycloak — —
Red Hat Red Hat Build of Keycloak — —
Red Hat Red Hat JBoss Enterprise Application Platform Expansion Pack — —
Weakness (CWE)
CWESourceDescription
CWE-639 cna Authorization Bypass Through User-Controlled Key
CVSS scores (1)
ScoreSeverityVersionSourceVector
4.3 MEDIUM 3.1 cna CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
References (2)
Back to overview