Fine-Grained Admin Permissions Bypass in Keycloak

Executive Summary

This vulnerability is an authorization bypass issue in Keycloak's Fine-Grained Admin Permissions (FGAP) v2 implementation, specifically in the GroupResource.getSubGroups() function. When FGAP v2 is enabled, the system fails to properly filter child groups based on the caller's permissions. As a result, a delegated administrator with permission to view a parent group can access details of child groups they are not authorized to see, including group names, paths, UUIDs, subgroup counts, and custom attributes.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows an attacker with delegated admin rights and view permission on a parent group to enumerate and access sensitive information about child groups they should not have access to. This unauthorized disclosure can lead to exposure of confidential group details, potentially aiding further attacks or unauthorized access within the system.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by sending a request to the Keycloak administrative endpoint that lists child groups of a parent group, specifically the /groups/{parentGroupId}/children endpoint.

If the system is vulnerable, a delegated administrator with Groups:view permission on a parent group can enumerate child groups they are not authorized to access. The response will include unauthorized child groups with an access.view=false flag indicating the bypass.

A practical detection command could be a curl request like:

• curl -H "Authorization: Bearer <delegated_admin_token>" https://<keycloak-server>/auth/admin/realms/<realm>/groups/<parentGroupId>/children

If the response contains child groups with access.view=false, it indicates the vulnerability is present.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability allows delegated administrators to access details of child groups they are not authorized to view, including sensitive information such as group names, paths, and custom attributes.

Such unauthorized disclosure of sensitive information could potentially lead to non-compliance with data protection regulations like GDPR and HIPAA, which require strict access controls and protection of personal or sensitive data.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate the CVE-2026-14615 vulnerability, it is important to restrict delegated administrator access to parent groups until a fix is applied.

Since the issue arises when Fine-Grained Admin Permissions (FGAP) v2 is enabled, consider temporarily disabling FGAP v2 if feasible, or limiting the use of delegated admin roles with Groups:view permission on parent groups.

Monitor for updates or patches from the Keycloak or Red Hat Product Security teams and apply them promptly once available.

Useful 0 Not Useful 0