A flaw was found in the group search functionality of the Keycloak server's administrative API. When Fine-Grained Admin Permissions (FGAP) v2 is enabled, a delegated administrator can bypass access restrictions to view parent groups they are not authorized to see. By searching for a child group they have permission to view, the system incorrectly returns the full details of the parent group in the response, leading to the disclosure of sensitive group attributes and configuration.
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions |
|---|---|---|---|
| Red Hat | Red Hat Build of Keycloak | affected | — |
| Red Hat | Red Hat Build of Keycloak | affected | — |
| Red Hat | Red Hat Build of Keycloak | affected | — |
| Red Hat | Red Hat Data Grid 8 | affected | — |
| Red Hat | Red Hat JBoss Enterprise Application Platform Expansion Pack | affected | — |
| Red Hat | Red Hat Single Sign-On 7 | affected | — |
No data.
No data.
No data.
Project Subscriptions
Advisories
No advisories yet.
Fixes
Solution
No solution given by the vendor.
Workaround
No workaround given by the vendor.
References
History
Thu, 16 Jul 2026 18:00:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | A flaw was found in the group search functionality of the Keycloak server's administrative API. When Fine-Grained Admin Permissions (FGAP) v2 is enabled, a delegated administrator can bypass access restrictions to view parent groups they are not authorized to see. By searching for a child group they have permission to view, the system incorrectly returns the full details of the parent group in the response, leading to the disclosure of sensitive group attributes and configuration. | |
| Title | Keycloak-services: keycloak-services: group hierarchy search discloses hidden parent groups under fgap v2 | |
| First Time appeared |
Redhat
Redhat build Keycloak Redhat jboss Data Grid Redhat jbosseapxp Redhat red Hat Single Sign On |
|
| Weaknesses | CWE-639 | |
| CPEs | cpe:/a:redhat:build_keycloak: cpe:/a:redhat:jboss_data_grid:8 cpe:/a:redhat:jbosseapxp cpe:/a:redhat:red_hat_single_sign_on:7 |
|
| Vendors & Products |
Redhat
Redhat build Keycloak Redhat jboss Data Grid Redhat jbosseapxp Redhat red Hat Single Sign On |
|
| References |
| |
| Metrics |
cvssV3_1
|
Projects
Sign in to view the affected projects.
MITRE
Status: PUBLISHED
Assigner: redhat
Published:
Updated: 2026-07-16T17:36:24.856Z
Reserved: 2026-07-16T12:26:48.913Z
Link: CVE-2026-15945
Vulnrichment
No data.
NVD
No data.
Redhat
No data.
OpenCVE Enrichment
No data.
Weaknesses