Skip to content
Fencer Vulns
medium 4.3

CVE-2026-14613 json

Keycloak-services: keycloak-services: keycloak: fgap v2 role groups endpoint discloses hidden group metadata without group view permission

published 2026-07-03 4 mo ago modified 2026-09-08 2 mo ago also BIT-keycloak-2026-14613 , EUVD-2026-41555

cvss
4.3
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.4%
EPSS 0.4% chance of exploitation in 30 days, percentile 31%
public exploits
0
none known

Summary

A vulnerability was discovered in Keycloak's administrative interface that allows certain administrators to see information about groups they shouldn't have access to. When the new Fine-Grained Admin Permissions (FGAP v2) are turned on, an administrator who is allowed to see a specific "role" can also see a list of all groups assigned to that role. The system fails to check if the administrator has permission to see those specific groups. This could allow a restricted administrator to discover "hidden" groups and see their details, such as internal names and custom settings, which might contain sensitive deployment information.

Patch / fix

  • bitnami keycloak 26.7.2
  • Red Hat Red Hat build of Keycloak 26.6 26.6-12, 26.6.6-1

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-14613 updated cvss 4.3

keycloak-services: keycloak-services: Keycloak: FGAP v2 role groups endpoint discloses hidden group metadata without group view permission

  • Red Hat build of Keycloak 26.6 rhbk/keycloak-rhel9 26.6-12, rhbk/keycloak-rhel9-operator 26.6-12, rhbk/keycloak-operator-bundle 26.6.6-1
    fixed: vendor fix RHSA-2026:56524
  • Red Hat build of Keycloak 26.6.6
    fixed: vendor fix RHSA-2026:56523
  • Red Hat Build of Keycloak rhbk-openshift-rhel9, keycloak-services 26.6.4.redhat-00004 Red Hat Data Grid 8 keycloak-services 26.6.4.redhat-00004 Red Hat JBoss Enterprise Application Platform Expansion Pack keycloak-services 26.6.4.redhat-00004 Red Hat Single Sign-On 7 keycloak-services 26.6.4.redhat-00004
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
partial
Assessed
4 mo ago

Exploit prediction

0.38% chance of exploitation in the next 30 days, higher than 31% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
NVD 3.1 4.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
OSV 3.1 4.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

Affected packages

ecosystem package affected fixed in
bitnami keycloak
<26.7.2
26.7.2

Affected products

  • Red Hat Red Hat build of Keycloak 26.6
  • Red Hat Red Hat build of Keycloak 26.6.6
  • Red Hat Red Hat Build of Keycloak
  • Red Hat Red Hat Data Grid 8
  • Red Hat Red Hat JBoss Enterprise Application Platform Expansion Pack
  • Red Hat Red Hat Single Sign-On 7

Classification

Weakness
  • CWE-1220 Insufficient Granularity of Access Control
  • CWE-284 Improper Access Control

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.