CVE-2026-14613

mediumpriority · track · 20EPSS 0.004 · 30 %ileDEEUNLUS

grimoire priorityP3 · Track

Exploitable?

—

no known exploitation

Likely / severe?

0.38% (30th) EPSS

CVSS 4.9 · medium

Is it mine?

11 products

Check your exposure

Who says so?

6 sources

cnnvd · enisa_euvd · cert_bund · ncsc_nl

EPSS · scored 2026-10-22

A vulnerability was discovered in Keycloak's administrative interface that allows certain administrators to see information about groups they shouldn't have access to. When the new Fine-Grained Admin Permissions (FGAP v2) are turned on, an administrator who is allowed to see a specific "role" can also see a list of all groups assigned to that role. The system fails to check if the administrator has permission to see those specific groups. This could allow a restricted administrator to discover "hidden" groups and see their details, such as internal names and custom settings, which might contain sensitive deployment information.

cvss

Technical severity, 0–10. One row per scoring source.

4.9

010

base score 0–10 · higher = more severe · hover a vector to decode

v3.14.9mediumCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:Nprimary · NVD / NIST USexploitability 1.2 · impact 3.6

v3.14.3mediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:Nsecondary · ENISA EU

v3.14.3mediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:Nsecondary · secalert@redhat.com USexploitability 2.8 · impact 1.4

v3.14.5mediumCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N/E:Usecondary · CVSS-BT (t0sche)

v3.14.3mediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:Nsecondary · NCSC-NL NL

ssvc

A stakeholder decision — act, attend, or track — from exploitation and impact.

Trackcoordinatorcisa_ssvcUS

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-1220USprimaryCWE-284US

affected products (11)

Products and version ranges known to be affected.

Open Source Keycloakall versionscert_bundDEcpe:/a:keycloak:keycloak:-
Open Source Keycloak <26.7.2all versionscert_bundDE
Open Source Keycloak <26.8.0all versionscert_bundDE
Red Hat Enterprise Linuxall versionscert_bundDEcpe:/o:redhat:enterprise_linux:-
Red Hat Enterprise Linux Keycloakall versionscert_bundDEcpe:/o:redhat:enterprise_linux:keycloak
Open Source Keycloak< 26.7.2cert_bundDE
Open Source Keycloak< 26.8.0cert_bundDE
Red Hat Build of Keycloak≤ vers:unknown/*ncsc_nlNL
keycloak KeyCloak≤ vers:unknown/*ncsc_nlNL
redhat build of keycloakall versionsnvdUScpe:2.3:a:redhat:build_of_keycloak:*:*:*:*:*:*:*:*
Bitnami keycloak< 26.7.2osvUSpkg:bitnami/keycloak

advisories (3)

Vendor and ecosystem advisories describing this.

NCSC-2026-0326Kwetsbaarheden verholpen in KeycloakNL2026-08-25csaf · ncsc_nlNL
Red Hat heeft meerdere kwetsbaarheden verholpen in Keycloak.
WID-SEC-W-2026-2198Keycloak: Mehrere SchwachstellenDeutsch2026-07-05csaf · cert_bundDE
Ein Angreifer kann mehrere Schwachstellen in Keycloak ausnutzen, um Informationen offenzulegen, Sicherheitsmaßnahmen zu umgehen, Daten zu manipulieren oder erweiterte Berechtigungen zu erlangen.
BIT-keycloak-2026-14613Keycloak-services: keycloak-services: keycloak: fgap v2 role groups endpoint discloses hidden group metadata without group view permission2026-08-25vendor · osvUS
A vulnerability was discovered in Keycloak's administrative interface that allows certain administrators to see information about groups they shouldn't have access to. When the new Fine-Grained Admin Permissions (FGAP v2) are turned on, an administrator who is allowed to see a specific "role" can also see a list of all groups assigned to that role. The system fails to check if the administrator has permission to see those specific groups. This could allow a restricted administrator to discover "hidden" groups and see their details, such as internal names and custom settings, which might contain sensitive deployment information.

also known as (3)

Other names and identifiers for this entity.

sources

Which sources assert this record, and when.

cnnvd enisa_euvd cert_bund ncsc_nl nvd osv NVD CVE.org MITRE

published 2026-07-03modified 2026-08-31

related (145)

Related entries.

ID	severity	EPSS	exploitable	published
CVE-2026-56155US	—OT critical	0.35% (27th)	KEV	2026-07-14
Insufficient granularity of access control in Active Directory Federation Services (AD FS) allows an authorized attacker to elevate privileges locally.
CVE-2026-33825US	—OT critical	0.40% (33rd)	KEV	2026-04-14
Insufficient granularity of access control in Microsoft Defender allows an authorized attacker to elevate privileges locally.
CVE-2025-31201US	—OT critical	13.9% (97th)	KEV	2025-04-16
This issue was addressed by removing the vulnerable code. This issue is fixed in iOS 18.4.1 and iPadOS 18.4.1, macOS Sequoia 15.4.1, tvOS 18.4.1, visionOS 2.4.1. An attacker with a…
CVE-2023-43040US	critical9.8	3.06% (88th)	Exploit	2024-05-14
IBM Spectrum Fusion HCI 2.5.2 through 2.7.2 could allow an attacker to perform unauthorized actions in RGW for Ceph due to improper bucket access. IBM X-Force ID: 266807.
CVE-2024-42365US	high8.8	4.67% (92nd)	Exploit	2024-08-08
Asterisk is an open source private branch exchange (PBX) and telephony toolkit. Prior to asterisk versions 18.24.2, 20.9.2, and 21.4.2 and certified-asterisk versions 18.9-cert11 a…

+140 more

references (8)

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan