CVE-2026-15945 is an authorization bypass vulnerability in the Red Hat Build of Keycloak server's administrative API. When Fine-Grained Admin Permissions (FGAP) v2 is enabled, delegated administrators can exploit the group search feature to view parent groups they are not authorized to access. Specifically, searching for a permitted child group causes the API to return full details of the parent group, leading to unintended disclosure of sensitive group attributes and configuration data. This flaw affects confidentiality but does not impact integrity or availability. No patch or official remediation level is currently stated in the vendor advisory.

The vulnerability allows unauthorized disclosure of sensitive group information within the Keycloak administrative API. This could lead to information leakage about group configurations and attributes that delegated administrators should not see. There is no indication of impact on data integrity or system availability. No known exploits in the wild have been reported.

Patch status is not yet confirmed — check the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-15945 for current remediation guidance. Until an official fix is available, consider restricting delegated administrator permissions or disabling Fine-Grained Admin Permissions v2 if feasible to limit exposure. Monitor vendor communications for updates on patches or workarounds.