4.3Mittel
CVE-2026-15945Keycloak-services: keycloak-services: group hierarchy search discloses hidden parent groups under fgap v2
Beschreibung
A flaw was found in the group search functionality of the Keycloak server's administrative API. When Fine-Grained Admin Permissions (FGAP) v2 is enabled, a delegated administrator can bypass access restrictions to view parent groups they are not authorized to see. By searching for a child group they have permission to view, the system incorrectly returns the full details of the parent group in the response, leading to the disclosure of sensitive group attributes and configuration.
Schwachstellentyp (CWE):
CWE-639
Daten: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Wiedergegeben wie in der Quelle, auf Englisch.
Betroffene Produkte und Versionen
| Hersteller | Produkt | Versionen | |
|---|---|---|---|
| build keycloak | 26.6 | — | |
| redhat | build of keycloak | — | |
| redhat | data grid | 8.0 | |
| redhat | jboss enterprise application platform expansion pack | — | |
| Red Hat | Red Hat build of Keycloak 26.6 | all versions | |
| Red Hat | Red Hat build of Keycloak 26.6.7 | — | |
| Red Hat | Red Hat Data Grid 8 | all versions | |
| Red Hat | Red Hat JBoss Enterprise Application Platform Expansion Pack | all versions | |
| Red Hat | Red Hat Single Sign-On 7 | all versions | |
| redhat | single sign-on | 7.0 |
Referenzen und Patches
- RHSA-2026:68277 vendor-advisory
- RHSA-2026:68278 vendor-advisory
- https://access.redhat.com/security/cve/CVE-2026-15945 vdb-entryVendor Advisory
- RHBZ#2501302 issue-trackingIssue TrackingVendor Advisory
CPE-Treffer (NVD) (4)
cpe:2.3:a:redhat:build_of_keycloak:-:*:*:*:-:*:*:*cpe:2.3:a:redhat:data_grid:8.0:*:*:*:*:*:*:*cpe:2.3:a:redhat:jboss_enterprise_application_platform_expansion_pack:-:*:*:*:*:*:*:*cpe:2.3:a:redhat:single_sign-on:7.0:*:*:*:*:*:*:*