CVE-2026-14613 – Keycloak-services: keycloak-services: keycloak: fgap v2 role groups endpoint discloses hidden group metadata without group view permission

CVE ID :CVE-2026-14613

Published : July 3, 2026, 3:16 p.m. | 2 hours, 30 minutes ago

Description :A vulnerability was discovered in Keycloak’s administrative interface that allows certain administrators to see information about groups they shouldn’t have access to. When the new Fine-Grained Admin Permissions (FGAP v2) are turned on, an administrator who is allowed to see a specific “role” can also see a list of all groups assigned to that role. The system fails to check if the administrator has permission to see those specific groups. This could allow a restricted administrator to discover “hidden” groups and see their details, such as internal names and custom settings, which might contain sensitive deployment information.

Severity: 4.3 | MEDIUM

Visit the link for more details, such as CVSS details, affected products, timeline, and more…