Veille CVE
CVE-2026-14615
2.7 FaibleDescription
A flaw was found in the Fine-Grained Admin Permissions (FGAP) v2 implementation within Keycloak's administrative services. When FGAP v2 is enabled, the system fails to properly filter child groups based on the caller's specific permissions when requested through a parent group. This allows a delegated administrator to view details of child groups they are not authorized to access directly, including group names, paths, and custom attributes.
Produits concernés
Scores CVSS
| Version | Score | Source | Vecteur |
|---|---|---|---|
| 3.1 | 4.3 Moyenne | secalert@redhat.com | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N |
| 3.1 | 2.7 Faible | nvd@nist.gov (NVD) | CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N |
Faiblesses (CWE)
Références
- https://access.redhat.com/errata/RHSA-2026:50846 Vendor Advisory
- https://access.redhat.com/errata/RHSA-2026:50847 Vendor Advisory
- https://access.redhat.com/errata/RHSA-2026:50848 Vendor Advisory
- https://access.redhat.com/errata/RHSA-2026:50849 Vendor Advisory
- https://access.redhat.com/security/cve/CVE-2026-14615 Vendor Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2496891 Issue TrackingVendor Advisory