CVE-2026-14615

Katalog CVE

CVSS 2.7 · Low EPSS 0,38%

Kerentanan Insufficient Granularity of Access Control pada redhat build of keycloak. Skor CVSS 3.1 2.7 (Low) menurut NVD.

Deskripsi (NVD)

A flaw was found in the Fine-Grained Admin Permissions (FGAP) v2 implementation within Keycloak's administrative services. When FGAP v2 is enabled, the system fails to properly filter child groups based on the caller's specific permissions when requested through a parent group. This allows a delegated administrator to view details of child groups they are not authorized to access directly, including group names, paths, and custom attributes.

Rincian

Terbit di NVD

3 Juli 2026

Terakhir diubah

11 Agustus 2026

Status NVD

Analyzed

CVSS 3.1

2.7 (Low), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-1220: Insufficient Granularity of Access Control

EPSS (30 hari)

0,38% peluang dieksploitasi; lebih tinggi dari 29,8% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://access.redhat.com/errata/RHSA-2026:50846 advisory vendor
• https://access.redhat.com/errata/RHSA-2026:50847 advisory vendor
• https://access.redhat.com/errata/RHSA-2026:50848 advisory vendor
• https://access.redhat.com/errata/RHSA-2026:50849 advisory vendor
• https://access.redhat.com/security/cve/CVE-2026-14615 advisory vendor
• https://bugzilla.redhat.com/show_bug.cgi?id=2496891 issue tracking · advisory vendor