CVE-2026-14613

mediumPriorität · verfolgen · 20EPSS 0.004 · 30. PerzentilDEEUNLUS

grimoire priorityP3 · Track

Exploitable?

—

no known exploitation

Likely / severe?

0.38% (30th) EPSS

CVSS 4.9 · medium

Is it mine?

11 products

Prüfe deine Angriffsfläche

Who says so?

6 sources

cnnvd · enisa_euvd · cert_bund · ncsc_nl

EPSS · bewertet 2026-10-22

A vulnerability was discovered in Keycloak's administrative interface that allows certain administrators to see information about groups they shouldn't have access to. When the new Fine-Grained Admin Permissions (FGAP v2) are turned on, an administrator who is allowed to see a specific "role" can also see a list of all groups assigned to that role. The system fails to check if the administrator has permission to see those specific groups. This could allow a restricted administrator to discover "hidden" groups and see their details, such as internal names and custom settings, which might contain sensitive deployment information.

cvss

Technischer Schweregrad, 0–10. Eine Zeile je Quelle.

4.9

010

Basiswert 0–10 · höher = schwerwiegender · Vektor überfahren zum Auflösen

v3.14.9mediumCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:Nprimary · NVD / NIST USAusnutzbarkeit 1.2 · Auswirkung 3.6

v3.14.3mediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:Nsecondary · ENISA EU

v3.14.3mediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:Nsecondary · secalert@redhat.com USAusnutzbarkeit 2.8 · Auswirkung 1.4

v3.14.5mediumCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N/E:Usecondary · CVSS-BT (t0sche)

v3.14.3mediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:Nsecondary · NCSC-NL NL

SSVC

Eine Handlungsentscheidung — aus Ausnutzung und Auswirkung.

Trackcoordinatorcisa_ssvcUS

schwächen

Die CWE-Schwächeklassen, zu denen dies gehört.

CWE-1220USprimärCWE-284US

betroffene Produkte (11)

Betroffene Produkte und Versionsbereiche.

Open Source Keycloakalle Versionencert_bundDEcpe:/a:keycloak:keycloak:-
Open Source Keycloak <26.7.2alle Versionencert_bundDE
Open Source Keycloak <26.8.0alle Versionencert_bundDE
Red Hat Enterprise Linuxalle Versionencert_bundDEcpe:/o:redhat:enterprise_linux:-
Red Hat Enterprise Linux Keycloakalle Versionencert_bundDEcpe:/o:redhat:enterprise_linux:keycloak
Open Source Keycloak< 26.7.2cert_bundDE
Open Source Keycloak< 26.8.0cert_bundDE
Red Hat Build of Keycloak≤ vers:unknown/*ncsc_nlNL
keycloak KeyCloak≤ vers:unknown/*ncsc_nlNL
redhat build of keycloakalle VersionennvdUScpe:2.3:a:redhat:build_of_keycloak:*:*:*:*:*:*:*:*
Bitnami keycloak< 26.7.2osvUSpkg:bitnami/keycloak

Advisories (3)

Hersteller- und Ökosystem-Meldungen dazu.

NCSC-2026-0326Kwetsbaarheden verholpen in KeycloakNL2026-08-25csaf · ncsc_nlNL
Red Hat heeft meerdere kwetsbaarheden verholpen in Keycloak.
WID-SEC-W-2026-2198Keycloak: Mehrere SchwachstellenDeutsch2026-07-05csaf · cert_bundDE
Ein Angreifer kann mehrere Schwachstellen in Keycloak ausnutzen, um Informationen offenzulegen, Sicherheitsmaßnahmen zu umgehen, Daten zu manipulieren oder erweiterte Berechtigungen zu erlangen.
BIT-keycloak-2026-14613Keycloak-services: keycloak-services: keycloak: fgap v2 role groups endpoint discloses hidden group metadata without group view permission2026-08-25vendor · osvUS
A vulnerability was discovered in Keycloak's administrative interface that allows certain administrators to see information about groups they shouldn't have access to. When the new Fine-Grained Admin Permissions (FGAP v2) are turned on, an administrator who is allowed to see a specific "role" can also see a list of all groups assigned to that role. The system fails to check if the administrator has permission to see those specific groups. This could allow a restricted administrator to discover "hidden" groups and see their details, such as internal names and custom settings, which might contain sensitive deployment information.

auch bekannt als (3)

Weitere Namen und Kennungen dieser Entität.

quellen

Welche Quellen diesen Datensatz belegen und wann.

cnnvd enisa_euvd cert_bund ncsc_nl nvd osv NVD CVE.org MITRE

veröffentlicht 2026-07-03geändert 2026-08-31

verwandt (145)

Verwandte Einträge.

ID	Schweregrad	EPSS	ausnutzbar	veröffentlicht
CVE-2026-56155US	—OT kritisch	0.35% (27th)	KEV	2026-07-14
Insufficient granularity of access control in Active Directory Federation Services (AD FS) allows an authorized attacker to elevate privileges locally.
CVE-2026-33825US	—OT kritisch	0.40% (33rd)	KEV	2026-04-14
Insufficient granularity of access control in Microsoft Defender allows an authorized attacker to elevate privileges locally.
CVE-2025-31201US	—OT kritisch	13.9% (97th)	KEV	2025-04-16
This issue was addressed by removing the vulnerable code. This issue is fixed in iOS 18.4.1 and iPadOS 18.4.1, macOS Sequoia 15.4.1, tvOS 18.4.1, visionOS 2.4.1. An attacker with a…
CVE-2023-43040US	critical9.8	3.06% (88th)	Exploit	2024-05-14
IBM Spectrum Fusion HCI 2.5.2 through 2.7.2 could allow an attacker to perform unauthorized actions in RGW for Ceph due to improper bucket access. IBM X-Force ID: 266807.
CVE-2024-42365US	high8.8	4.67% (92nd)	Exploit	2024-08-08
Asterisk is an open source private branch exchange (PBX) and telephony toolkit. Prior to asterisk versions 18.24.2, 20.9.2, and 21.4.2 and certified-asterisk versions 18.9-cert11 a…

+140 weitere

Referenzen (8)

Externe Belege — Patches, Meldungen, Analysen.

scry

Angreifer nutzen Schwachstellen wie diese gegen im Internet exponierte Dienste aus. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.

Kostenloser Scan