CVE-2026-14615: Keycloak FGAP v2 Permission Filter Bypass Enables Unauthorized Group Metadata Disclosure

Technical summary

The vulnerability stems from insufficient permission validation in Keycloak's FGAP v2 implementation when processing parent group queries. Specifically, when a delegated administrator requests information about a parent group, the resulting child group details are not filtered according to the caller's granular permissions. An attacker with delegated admin credentials can enumerate nested group metadata by querying parent groups, bypassing the permission model that should prevent such access. The flaw affects the administrative API layer and requires authentication (PR:L in the CVSS vector), meaning unauthenticated attackers cannot exploit it. The impact is limited to confidentiality; integrity and availability remain unaffected.

Business impact

This vulnerability introduces operational security risk by allowing delegated administrators—or compromised accounts with delegated privileges—to discover organizational structure and group configurations they are not authorized to see. In multi-tenant or highly compartmentalized Keycloak deployments, this could undermine role-based access control (RBAC) isolation and expose sensitive metadata about business units, teams, or customer groups. The disclosure is particularly concerning in regulated environments where segregation of duties and least-privilege access are compliance requirements. However, the low CVSS score and lack of impact on data modification or system availability suggest this is not a critical incident driver in most environments.

Affected systems

Red Hat Build of Keycloak is affected when FGAP v2 is enabled. The vulnerability does not impact Keycloak deployments with FGAP v2 disabled or using the original fine-grained permissions model. Organizations running community Keycloak should verify whether they have FGAP v2 enabled and check Red Hat advisories for scope confirmation. The flaw requires an authenticated delegated administrator account to trigger, so isolated or development Keycloak instances with minimal delegation may face lower practical risk.

Exploitability

Exploitation requires valid delegated administrator credentials and is triggered through normal administrative API queries. No special network conditions, user interaction, or complex attack chains are required—an authenticated attacker can retrieve unauthorized group information via standard Keycloak REST endpoints. The simplicity of exploitation is offset by the requirement for authenticated access and the limitation to information disclosure only. The vulnerability is not listed in CISA's Known Exploited Vulnerabilities (KEV) catalog, indicating no evidence of active exploitation in the wild at this time.

Remediation

Apply security updates released by Red Hat for Keycloak that address FGAP v2 permission filtering. Organizations should verify patch availability through Red Hat's security advisories and test updates in non-production environments before deployment. As an interim control, restrict delegated administrator role assignments to trusted staff and audit existing delegated admin accounts. Consider disabling FGAP v2 if not required for your access control model, reverting to the standard fine-grained permissions framework until patching is complete. Monitor administrative API logs for unusual parent group queries that may indicate reconnaissance activity.

Patch guidance

Consult Red Hat's official security advisory for Keycloak CVE-2026-14615 to obtain the specific patched version and deployment instructions. Test patches against your administrative workflows to confirm that the permission filtering fix does not disrupt legitimate delegated admin operations. If using Red Hat Build of Keycloak, follow Red Hat's release cadence and errata process. Community Keycloak users should track upstream advisories and apply fixes aligned with your release branch. After patching, re-validate that delegated admins can no longer view unauthorized child group details through parent group queries.

Detection guidance

Enable audit logging on Keycloak's administrative API if not already active, paying special attention to group query operations and the accounts performing them. Look for patterns of repeated parent group queries by delegated admin accounts, particularly those queries that span organizational units the querying admin should not oversee. Review API access logs for unusual pagination or filtering parameters that might indicate enumeration attempts. Correlate delegated admin query activity against their assigned permissions to identify mismatches. Implement alerting on administrative API calls that return group metadata to non-admin users or to admins outside their authorized scope.

Why prioritize this

Despite the MEDIUM severity rating, this vulnerability merits prompt attention in organizations with strict access control or compliance requirements, because it directly undermines the purpose of fine-grained permissions—delegation with isolation. The lack of active exploitation (KEV-negative status) allows time for planned patching, but the ease of exploitation and the nature of the disclosure (metadata leakage) make it a natural candidate for early-cycle remediation. Prioritize patching if you: (1) rely heavily on delegated administration across business units, (2) operate in regulated industries with data governance mandates, or (3) use Keycloak to manage sensitive organizational hierarchies. Otherwise, follow your standard patch cycle.

Risk score, explained

The CVSS 3.1 score of 4.3 (MEDIUM) reflects a low attack complexity (AC:L), no user interaction required (UI:N), and a low-impact, confidentiality-only breach (C:L/I:N/A:N). The primary dampening factor is the requirement for prior authentication (PR:L), which prevents external attackers from exploiting the flaw. The local scope (S:U) indicates the impact is confined to the vulnerable system and not propagated across trust boundaries. While technically 'medium,' the practical risk depends on your delegation model and whether delegated admins have sufficiently restricted permissions to make the disclosed metadata sensitive.

Frequently asked questions