CVE-2026-18571 – Keycloak-services: keycloak-services: fgap v2 group assignment bypass during user creation

CVE ID :CVE-2026-18571

Published : Aug. 2, 2026, 6:16 a.m. | 1 hour, 35 minutes ago

Description :A flaw was found in the user creation component of Keycloak when Fine-Grained Admin Permissions V2 (FGAP V2) is enabled. This issue allows a sub-administrator with permission to create users to add those users to any group, even groups the sub-administrator is not authorized to manage. This could lead to unauthorized access to sensitive information or elevated privileges for the newly created users.

Severity: 6.6 | MEDIUM

Visit the link for more details, such as CVSS details, affected products, timeline, and more…