4.3Orta
CVE-2026-15945Keycloak-services: keycloak-services: group hierarchy search discloses hidden parent groups under fgap v2
Açıklama
A flaw was found in the group search functionality of the Keycloak server's administrative API. When Fine-Grained Admin Permissions (FGAP) v2 is enabled, a delegated administrator can bypass access restrictions to view parent groups they are not authorized to see. By searching for a child group they have permission to view, the system incorrectly returns the full details of the parent group in the response, leading to the disclosure of sensitive group attributes and configuration.
Zayıflık türü (CWE):
CWE-639
Veri: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Bilgiler kaynaktaki haliyle, İngilizce yayımlanır.
Etkilenen ürünler ve sürümler
| Üretici | Ürün | Sürümler | |
|---|---|---|---|
| build keycloak | 26.6 | — | |
| redhat | build of keycloak | — | |
| redhat | data grid | 8.0 | |
| redhat | jboss enterprise application platform expansion pack | — | |
| Red Hat | Red Hat build of Keycloak 26.6 | all versions | |
| Red Hat | Red Hat build of Keycloak 26.6.7 | — | |
| Red Hat | Red Hat Data Grid 8 | all versions | |
| Red Hat | Red Hat JBoss Enterprise Application Platform Expansion Pack | all versions | |
| Red Hat | Red Hat Single Sign-On 7 | all versions | |
| redhat | single sign-on | 7.0 |
Kaynaklar ve yamalar
- RHSA-2026:68277 vendor-advisory
- RHSA-2026:68278 vendor-advisory
- https://access.redhat.com/security/cve/CVE-2026-15945 vdb-entryVendor Advisory
- RHBZ#2501302 issue-trackingIssue TrackingVendor Advisory
CPE eşleşmeleri (NVD) (4)
cpe:2.3:a:redhat:build_of_keycloak:-:*:*:*:-:*:*:*cpe:2.3:a:redhat:data_grid:8.0:*:*:*:*:*:*:*cpe:2.3:a:redhat:jboss_enterprise_application_platform_expansion_pack:-:*:*:*:*:*:*:*cpe:2.3:a:redhat:single_sign-on:7.0:*:*:*:*:*:*:*