CVE-2026-18571
Received Received - Intake

Keycloak FGAP V2 User Group Privilege Escalation

Publication date: 2026-08-02

Last updated on: 2026-08-02

Assigner: Red Hat, Inc.

Description
A flaw was found in the user creation component of Keycloak when Fine-Grained Admin Permissions V2 (FGAP V2) is enabled. This issue allows a sub-administrator with permission to create users to add those users to any group, even groups the sub-administrator is not authorized to manage. This could lead to unauthorized access to sensitive information or elevated privileges for the newly created users.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-02
Last Modified
2026-08-02
Generated
2026-08-02
AI Q&A
2026-08-02
EPSS Evaluated
N/A
NVD
CVE-2026-18571
EUVD
EUVD-2026-51925

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
redhat keycloak *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is in Keycloak's user creation component when Fine-Grained Admin Permissions V2 (FGAP V2) is enabled. A sub-administrator with user creation rights can add new users to any group, even those they lack permission to manage. This could allow unauthorized access or privilege escalation.

Impact Analysis

If exploited, this flaw could let attackers create users with elevated privileges or access to sensitive groups they shouldn't manage. This may lead to data breaches, unauthorized actions, or system compromise depending on the environment.

Compliance Impact

This vulnerability could violate compliance requirements by enabling unauthorized access to sensitive data, potentially breaching GDPR (data protection) or HIPAA (health information privacy) regulations. Organizations may face penalties or audit failures if exploited.

Mitigation Strategies

Disable Fine-Grained Admin Permissions V2 (FGAP V2) in Keycloak if enabled. Review sub-administrator permissions to ensure they cannot create users in unauthorized groups. Monitor for unauthorized user creation or group assignments.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-18571. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart