CVE-2026-14209: Keycloak Admin UI Permission Bypass in Fine-Grained Access Control

Technical summary

CVE-2026-14209 is an authorization bypass vulnerability in Keycloak's Admin UI extension, affecting deployments with Fine-Grained Admin Permissions v2 (FGAPv2) enabled. The vulnerability exists in the 'brute-force-user' endpoint, which does not properly validate whether the requesting administrator holds the 'view' permission for the targeted user resource. The authorization check is bypassed, allowing a search-only administrator to circumvent granular permission boundaries and access complete user profiles and associated security metadata. This is classified as an improper permission enforcement issue (CWE-639).

Business impact

This vulnerability enables privilege escalation within the administrative tier. A constrained admin account—intended to perform limited user searches—gains unauthorized access to sensitive user information, potentially exposing credentials, security settings, audit logs, or authentication metadata. In multi-tenant or role-segregated environments, this can violate data governance policies and enable lateral reconnaissance. The breach of administrative boundaries may also trigger compliance violations under regulations requiring least-privilege access controls.

Affected systems

Red Hat build of Keycloak and Red Hat JBoss Enterprise Application Platform Expansion Pack are affected. Organizations running Keycloak with Fine-Grained Admin Permissions v2 enabled are at risk, particularly those relying on granular role separation for administrative access control. Environments without FGAPv2 enabled are not impacted by this specific flaw.

Exploitability

Exploitation requires valid administrative credentials and network access to the Keycloak Admin UI. No user interaction, special configurations beyond FGAPv2 enablement, or complex attack chains are needed. Once authenticated as a search-restricted admin, the attack is trivial—a direct API call to the unprotected endpoint. However, the requirement for pre-existing admin credentials prevents mass exploitation. CVSS score of 4.3 (Medium) reflects the low network complexity and high privilege barrier.

Remediation

Apply vendor security patches from Red Hat. Verify the patch version against Red Hat's official advisory for both Keycloak and JBoss Enterprise Application Platform Expansion Pack. If immediate patching is not feasible, review and audit Fine-Grained Admin Permissions configurations; consider temporarily disabling FGAPv2 if the policy benefit does not outweigh the risk, though this is a temporary measure only. Implement additional monitoring on the affected endpoint (brute-force-user) to detect anomalous access patterns from constrained admin accounts.

Patch guidance

Obtain the latest security advisory from Red Hat Security Updates. Download and deploy the patched Keycloak version and/or JBoss EAP Expansion Pack version specified in the advisory. Test patches in a staging environment that mirrors your FGAPv2 configuration before production rollout. Restart Keycloak services to activate the fix. Verify that Fine-Grained Admin Permissions still function correctly post-patch and that previously restricted admins can no longer access unauthorized user data via the brute-force-user endpoint.

Detection guidance

Monitor Admin UI audit logs for search-only administrators accessing the 'brute-force-user' endpoint, especially if they successfully retrieve full user profiles or security metadata. Implement alerting on API calls to this endpoint from accounts with 'search' but not 'view' permissions. Log analysis should focus on authentication context and permission claims at request time. In SIEM systems, correlate admin API calls with the granular permissions assigned to that admin account to identify violations of the principle of least privilege.

Why prioritize this

Although the CVSS score is Medium (4.3), the vulnerability directly undermines administrative access control architecture. In organizations using FGAPv2 for intentional role segregation—such as separating user search duties from user detail access—this is a critical control failure regardless of numeric score. Prioritize patching if your deployment enforces granular admin permissions as a security boundary. Lower priority if FGAPv2 is disabled or if all admins have equivalent permissions anyway.

Risk score, explained

The CVSS 3.1 score of 4.3 reflects: (1) network-accessible endpoint (AV:N); (2) low attack complexity requiring only a direct API call (AC:L); (3) requirement for valid admin login (PR:L); (4) no user interaction needed (UI:N); (5) confidentiality impact limited to unauthorized data access (C:L); (6) no integrity or availability impact (I:N, A:N); (7) unchanged scope (S:U). The score appropriately captures a low-barrier but contained information disclosure. Context matters: in environments where FGAPv2 enforces a security trust boundary, the real-world risk exceeds the numeric score.

Frequently asked questions