This vulnerability affects the Fine-Grained Admin Permissions (FGAP) v2 implementation in Keycloak's administrative services within the Red Hat build of Keycloak 26.4. Specifically, when FGAP v2 is enabled, the system fails to enforce per-child view permission filters on child groups requested through a parent group. As a result, delegated administrators with certain permissions can access metadata of child groups they should not be authorized to view, including sensitive information such as group names, paths, and custom attributes. The root cause is an improper conditional check in the group retrieval logic that bypasses permission filtering. The CVSS v3.1 base score is 4.3 (medium severity), reflecting low confidentiality impact and no integrity or availability impact. Red Hat has published a security advisory and released an updated package (version 26.4.14) that includes a fix for this vulnerability.

An attacker with delegated administrator privileges and specific permissions can exploit this vulnerability to disclose sensitive metadata of child groups that they are not authorized to access directly. This includes viewing group names, paths, and custom attributes. There is no impact on integrity or availability, and no indication of privilege escalation or code execution. The confidentiality impact is limited to unauthorized disclosure of group metadata.

Red Hat has released an updated package, Red Hat build of Keycloak 26.4.14, which addresses this vulnerability. Users should apply this security update to remediate the issue. Before applying the update, it is recommended to back up existing installations, including applications, configuration files, and databases. No additional mitigations are specified by Red Hat. Patch status is confirmed by the vendor advisory.