CVE-2026-14613: Vulnerability in Red Hat Red Hat Build of Keycloak
A vulnerability was discovered in Keycloak's administrative interface that allows certain administrators to see information about groups they shouldn't have access to. When the new Fine-Grained Admin Permissions (FGAP v2) are turned on, an administrator who is allowed to see a specific "role" can also see a list of all groups assigned to that role. The system fails to check if the administrator has permission to see those specific groups. This could allow a restricted administrator to discover "hidden" groups and see their details, such as internal names and custom settings, which might contain sensitive deployment information.
AI Analysis
Technical Summary
This vulnerability involves improper access control in Red Hat Build of Keycloak's administrative interface. Specifically, when FGAP v2 is enabled, an administrator authorized to view a role can also see all groups assigned to that role, regardless of whether they have permission to view those groups. The system fails to verify group-level permissions, leading to unauthorized disclosure of group information. The issue is classified under CWE-284 (Improper Access Control) and has a CVSS v3.1 base score of 4.3, indicating medium severity.
Potential Impact
The vulnerability allows a restricted administrator to gain unauthorized read access to group information that should be hidden. This could lead to exposure of sensitive internal group names and custom settings, which may reveal deployment details. There is no indication of impact on integrity or availability, and no known exploits are reported in the wild.
Mitigation Recommendations
Patch status is not yet confirmed — check the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-14613 for current remediation guidance. No official fix or workaround is explicitly stated in the provided advisory content. Administrators should review permissions and consider limiting the use of FGAP v2 until a fix is available.
CVE-2026-14613: Vulnerability in Red Hat Red Hat Build of Keycloak
Description
A vulnerability was discovered in Keycloak's administrative interface that allows certain administrators to see information about groups they shouldn't have access to. When the new Fine-Grained Admin Permissions (FGAP v2) are turned on, an administrator who is allowed to see a specific "role" can also see a list of all groups assigned to that role. The system fails to check if the administrator has permission to see those specific groups. This could allow a restricted administrator to discover "hidden" groups and see their details, such as internal names and custom settings, which might contain sensitive deployment information.
CVSS v3.1
Score 4.3medium
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
This vulnerability involves improper access control in Red Hat Build of Keycloak's administrative interface. Specifically, when FGAP v2 is enabled, an administrator authorized to view a role can also see all groups assigned to that role, regardless of whether they have permission to view those groups. The system fails to verify group-level permissions, leading to unauthorized disclosure of group information. The issue is classified under CWE-284 (Improper Access Control) and has a CVSS v3.1 base score of 4.3, indicating medium severity.
Potential Impact
The vulnerability allows a restricted administrator to gain unauthorized read access to group information that should be hidden. This could lead to exposure of sensitive internal group names and custom settings, which may reveal deployment details. There is no indication of impact on integrity or availability, and no known exploits are reported in the wild.
Mitigation Recommendations
Patch status is not yet confirmed — check the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-14613 for current remediation guidance. No official fix or workaround is explicitly stated in the provided advisory content. Administrators should review permissions and consider limiting the use of FGAP v2 until a fix is available.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- redhat
- Date Reserved
- 2026-07-03T14:48:35.343Z
- Cvss Version
- 3.1
- State
- PUBLISHED
- Remediation Level
- null
- Vendor Advisory Urls
- [{"url":"https://access.redhat.com/security/cve/CVE-2026-14613","vendor":"Red Hat"}]
Threat ID: 6a47d70527e9c79719e9929b
Added to database: 07/03/2026, 15:36:37 UTC
Last enriched: 07/18/2026, 15:47:57 UTC
Last updated: 08/17/2026, 00:41:09 UTC
Views: 110
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.