CVE-2026-14613: Insufficient Granularity of Access Control in Red Hat Red Hat build of Keycloak 26.6

The vulnerability in Red Hat build of Keycloak 26.6 arises from insufficient granularity in access control within the administrative interface when FGAP v2 is enabled. An administrator permitted to view a role can see all groups assigned to that role without the system checking if the administrator has permission to view those groups. This flaw allows restricted administrators to discover and view details of hidden groups, potentially exposing sensitive internal configuration data. The issue is tracked as CVE-2026-14613 with a CVSS 3.1 score of 4.3 (medium severity). Red Hat has issued security advisories RHSA-2026:56523 and RHSA-2026:56524 providing updates that fix this vulnerability in versions 26.6.6 and 26.7.2.

The vulnerability allows unauthorized disclosure of group metadata to administrators who should not have access, potentially exposing sensitive deployment information such as internal group names and custom settings. There is no indication of impact on integrity or availability, and no known exploits in the wild have been reported.

Red Hat has released fixed versions 26.6.6 and 26.7.2 of the Red Hat build of Keycloak that address this vulnerability. Users should apply these official updates as soon as possible. Before updating, back up existing installations including applications, configuration files, and databases. No additional mitigation steps are indicated by the vendor advisory.