Vendredi 3 juillet 2026

Red Hat build of Keycloak 26.4 · Red Hat build of Keycloak 26.4.14 · Red Hat build of Keycloak 26.6 · Red Hat build of Keycloak 26.6.5

A flaw was found in the ClientResource component of Keycloak's admin services when Fine-Grained Admin Permissions (FGAP) v2 is enabled. This issue allows a delegated administrator, who should only have limited control over specific clients, to attach or remove hidden client scopes that they are not authorized to see or manage. As a result, an attacker could inject unauthorized data or permissions into the security tokens issued to end-users, potentially tricking other applications into granting higher levels of access than intended.

Red Hat build of Keycloak 26.6 · Red Hat build of Keycloak 26.6.6 · Red Hat Build of Keycloak · Red Hat Data Grid 8

A vulnerability was discovered in Keycloak's administrative interface that allows certain administrators to see information about groups they shouldn't have access to. When the new Fine-Grained Admin Permissions (FGAP v2) are turned on, an administrator who is allowed to see a specific "role" can also see a list of all groups assigned to that role. The system fails to check if the administrator has permission to see those specific groups. This could allow a restricted administrator to discover "hidden" groups and see their details, such as internal names and custom settings, which might contain sensitive deployment information.