CVE-2026-15945

Katalog CVE

CVSS 2.7 · Low EPSS 0,35%

Kerentanan Authorization Bypass Through User-Controlled Key pada redhat build of keycloak, redhat data grid +2 lainnya. Skor CVSS 3.1 2.7 (Low) menurut NVD.

Deskripsi (NVD)

A flaw was found in the group search functionality of the Keycloak server's administrative API. When Fine-Grained Admin Permissions (FGAP) v2 is enabled, a delegated administrator can bypass access restrictions to view parent groups they are not authorized to see. By searching for a child group they have permission to view, the system incorrectly returns the full details of the parent group in the response, leading to the disclosure of sensitive group attributes and configuration.

Rincian

Terbit di NVD

16 Juli 2026

Terakhir diubah

16 September 2026

Status NVD

Modified

CVSS 3.1

2.7 (Low), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-639: Authorization Bypass Through User-Controlled Key

EPSS (30 hari)

0,35% peluang dieksploitasi; lebih tinggi dari 26,6% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://access.redhat.com/security/cve/CVE-2026-15945 advisory vendor
• https://bugzilla.redhat.com/show_bug.cgi?id=2501302 issue tracking · advisory vendor
• https://access.redhat.com/errata/RHSA-2026:68277
• https://access.redhat.com/errata/RHSA-2026:68278