Insufficient Granularity of Access Control in Red Hat build of Keycloak - CVE-2026-14615
Published: September 11, 2026
Vulnerability identifier: #VU148990
CSH Severity: Low
CVSS v4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-14615
CWE-ID: CWE-1220
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to disclose restricted group metadata and attributes.
The vulnerability exists due to an improper conditional check in group retrieval logic in Keycloak administrative services when retrieving child groups through a parent group. A remote user can request child groups through a parent group to disclose restricted group metadata and attributes.
Fine-Grained Admin Permissions v2 must be enabled.
Affected software
Red Hat build of Keycloak
How to mitigate CVE-2026-14615
Install security update from vendor's website.
Red Hat build of Keycloak - update to 26.6.5