Back to overview

CVE-2026-15945

MEDIUM
4.3
CVSS 3.1
Description
A flaw was found in the group search functionality of the Keycloak server's administrative API. When Fine-Grained Admin Permissions (FGAP) v2 is enabled, a delegated administrator can bypass access restrictions to view parent groups they are not authorized to see. By searching for a child group they have permission to view, the system incorrectly returns the full details of the parent group in the response, leading to the disclosure of sensitive group attributes and configuration.

Metadata

CVE ID
CVE-2026-15945
State
PUBLISHED
Assigner
redhat
Reserved
2026-07-16 12:26 UTC
Published
2026-07-16 17:36 UTC
Last updated
2026-07-17 14:00 UTC
Primary CWE
CWE-639
Authorization Bypass Through User-Controlled Key
Vendor / Product
Red Hat / Red Hat Build of Keycloak
Sources
cve.org  ·  NVD

Severity & Metrics

4.3 MEDIUM CVSS 3.1
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
SSVC — CISA Coordinator
Exploitation
none
Automatable
no
Tech. Impact
partial
Affected products (6)
VendorProductPlatformVersions
Red Hat Red Hat Build of Keycloak — —
Red Hat Red Hat Build of Keycloak — —
Red Hat Red Hat Build of Keycloak — —
Red Hat Red Hat Data Grid 8 — —
Red Hat Red Hat JBoss Enterprise Application Platform Expansion Pack — —
Red Hat Red Hat Single Sign-On 7 — —
Weakness (CWE)
CWESourceDescription
CWE-639 cna Authorization Bypass Through User-Controlled Key
CVSS scores (1)
ScoreSeverityVersionSourceVector
4.3 MEDIUM 3.1 cna CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
References (2)
Back to overview