CVE-2026-14613 is a vulnerability in Keycloak's administrative interface related to Fine-Grained Admin Permissions version 2 (FGAP v2). When FGAP v2 is enabled, an administrator authorized to view a specific role can also retrieve a list of all groups assigned to that role without the system verifying if the administrator has permission to view those groups. This results in unauthorized disclosure of group metadata, including internal group names and custom settings, potentially exposing sensitive deployment information. The vulnerability is classified under CWE-284 (Improper Access Control). Red Hat has issued patches in Keycloak 26.6.6 to fix this issue.

The vulnerability allows restricted administrators to discover and view details of groups they should not have access to, potentially exposing sensitive internal names and custom settings related to deployment. This unauthorized information disclosure could aid attackers or unauthorized users in understanding the internal structure and configuration of the system. However, the impact is limited to information disclosure (confidentiality) with no direct impact on integrity or availability.

Red Hat has released security updates in Keycloak version 26.6.6 that address this vulnerability. Users should apply these official patches to remediate the issue. Before updating, it is recommended to back up existing installations, including applications, configuration files, and databases. No additional mitigation steps are specified or required beyond applying the official fix.