CVE-2026-14613: Keycloak Fine-Grained Admin Permissions Authorization Bypass

Technical summary

CVE-2026-14613 is an improper access control vulnerability (CWE-284) in Red Hat build of Keycloak affecting the Fine-Grained Admin Permissions v2 feature. The administrative interface fails to enforce group-level visibility checks when enumerating groups associated with a role. An authenticated administrator with 'view role' permissions can enumerate and retrieve details about groups they have not been explicitly granted permission to access. The vulnerability manifests as a missing authorization validation step between role enumeration logic and group membership queries. The CVSS 3.1 score of 4.3 (Medium severity) reflects the requirement for administrative authentication and the limited scope of information disclosure (group metadata rather than sensitive end-user data).

Business impact

Organizations leveraging Keycloak's FGAP v2 to enforce administrative separation of duties face a direct compromise of that security model. Teams responsible for distinct environments, applications, or customer segments may discover that restricted administrators can identify and investigate groups outside their designated scope. This could expose internal organizational structures, deployment topologies, or group naming conventions that indicate sensitive infrastructure. In regulated environments, this may trigger findings during access control audits. The impact is primarily informational; however, disclosed group configurations could facilitate lateral reconnaissance or social engineering attacks by insiders.

Affected systems

Red Hat build of Keycloak is affected when the Fine-Grained Admin Permissions v2 feature is enabled. Organizations using Keycloak Community Edition or upstream Keycloak with FGAP v2 active should also assess exposure. The vulnerability is only exploitable by users holding administrative roles, making the blast radius directly proportional to the number of restricted admin accounts and the sensitivity of groups they are meant to be isolated from. Systems where FGAP v2 is not enabled are not affected by this specific authorization bypass.

Exploitability

Exploitability is low in real-world attack scenarios, as it requires valid administrative credentials and deliberate role enumeration. An attacker cannot weaponize this remotely without first obtaining admin access, which is itself a significant barrier. However, insider threats—disgruntled admins or compromised admin accounts—can trivially leverage this flaw to discover and profile groups across administrative boundaries. No active public exploits or proof-of-concept code has been widely circulated. The vulnerability is not tracked in the CISA Known Exploited Vulnerabilities (KEV) catalog.

Remediation

Apply security updates released by Red Hat for the affected build of Keycloak. Verify the patch version against Red Hat's official advisory to confirm the authorization check for group visibility has been implemented. As an interim measure, audit Fine-Grained Admin Permissions v2 configurations and limit the number of administrators granted role-viewing privileges to only those who require them. Consider disabling FGAP v2 temporarily in non-production environments to validate patch readiness. Supplement with monitoring of administrative API calls that enumerate groups or roles, flagging unusual access patterns.

Patch guidance

Consult Red Hat's security advisory for the specific patched version of Red Hat build of Keycloak. Apply patches in a staged approach: first to development and testing environments to validate compatibility with your authentication workflows, then to production systems during a maintenance window. Verify after patching that role-to-group queries now properly enforce the requesting administrator's group visibility scope. Test role enumeration across multiple restricted admin accounts to confirm authorization boundaries are respected.

Detection guidance

Monitor administrative audit logs for instances where non-privileged administrators query or enumerate groups outside their designated scope. Look for repeated calls to group listing or group detail endpoints originating from admin accounts with limited FGAP v2 permissions. Correlate admin role assignments with subsequent group access patterns. In Keycloak deployments with verbose logging enabled, search for authorization denials or permission checks on group visibility that may indicate attempted exploitation. Implement alerting on admin accounts querying groups they lack explicit permissions to view.

Why prioritize this

This vulnerability should be prioritized if your organization has Fine-Grained Admin Permissions v2 enabled and relies on role-based administrative segregation to enforce least-privilege access. Priority is highest in multi-tenant or highly compartmentalized environments where group isolation is a security boundary. Conversely, organizations running Keycloak without FGAP v2 active can defer patching to a routine update cycle. The CVSS 4.3 score and lack of active exploitation keep this at medium priority, but the direct threat to administrative access control models warrants timely remediation.

Risk score, explained

CVSS 3.1 score of 4.3 (Medium) is driven by: (1) Network accessibility (AV:N) and low attack complexity (AC:L) reflecting the web-based admin interface; (2) Low privileges required (PR:L)—administrative credentials are necessary; (3) No user interaction (UI:N); (4) Unchanged scope (S:U); and (5) Low confidentiality impact (C:L) since only group metadata is disclosed, not sensitive end-user or system data. The score does not escalate to High because exploitation requires valid admin credentials, and the information disclosed (group names, settings) is typically not as sensitive as user credentials or cryptographic keys. Organizations should treat this as elevated within the Medium range given its direct threat to administrative access controls.

Frequently asked questions