This vulnerability affects the group search functionality in the Keycloak administrative API under Fine-Grained Admin Permissions (FGAP) v2. A delegated administrator with permission to view a child group can exploit this flaw to retrieve full details of the parent group, bypassing intended access restrictions. The issue results in unauthorized information disclosure of sensitive group attributes and configurations. The CVSS 3.1 base score is 4.3 (medium), reflecting low complexity and network attack vector but limited impact to confidentiality only. No official remediation level or patch information is provided in the vendor advisory at this time.

The vulnerability allows unauthorized disclosure of sensitive group attributes and configuration data by bypassing access controls in the administrative API. There is no impact on integrity or availability. No known exploits in the wild have been reported.

Patch status is not yet confirmed — check the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-15945 for current remediation guidance. Until a fix is available, consider restricting delegated administrator permissions or disabling Fine-Grained Admin Permissions (FGAP) v2 if feasible to reduce exposure.