Keycloak FGAP v2 Group Search Access Bypass

Executive Summary

This is an information disclosure vulnerability in Keycloak's administrative API. When Fine-Grained Admin Permissions (FGAP) v2 is enabled, a delegated administrator can bypass access restrictions by searching for a child group they are authorized to view. The system incorrectly returns full details of unauthorized parent groups in the response, exposing sensitive group attributes and configuration.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check Keycloak server logs for unauthorized access attempts to the GET /admin/realms/{realm}/groups endpoint with search parameters and briefRepresentation=false. Look for responses containing parent group details despite 403 errors for direct access.

Useful 0 Not Useful 0

Impact Analysis

An attacker with a valid account and specific permissions (query-groups and Groups:view on at least one child group) could exploit this flaw to disclose sensitive information about unauthorized parent groups. This includes internal UUIDs, group names, custom group attributes, and role mappings associated with restricted parent groups.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized disclosure of sensitive group attributes and configuration, potentially violating data protection requirements under GDPR, HIPAA, or other regulations that mandate strict access controls and confidentiality of personal or health information.

Useful 0 Not Useful 0

Mitigation Strategies

Disable Fine-Grained Admin Permissions (FGAP) v2 if enabled. Restrict access to the /admin/realms/{realm}/groups endpoint. Monitor logs for suspicious search queries. Apply patches from Red Hat once available.

Useful 0 Not Useful 0