CVE-2026-18571 describes a missing authorization flaw in the user creation component of Red Hat Build of Keycloak when Fine-Grained Admin Permissions V2 (FGAP V2) is enabled. Specifically, sub-administrators permitted to create users can assign those users to any group regardless of their group management permissions. This bypass of group membership restrictions may result in unauthorized access to sensitive information or elevated privileges for the newly created users. The vulnerability has a CVSS v3.1 base score of 6.6, reflecting network attack vector, high complexity, high privileges required, no user interaction, and high impact on confidentiality, integrity, and availability. The vendor advisory linked does not provide explicit patch or remediation details, and no affected versions are specified.

Exploitation of this vulnerability allows sub-administrators with user creation rights to assign new users to unauthorized groups, potentially granting those users elevated privileges or access to sensitive data. This undermines the intended access control model and could lead to unauthorized information disclosure, privilege escalation, and disruption of service within environments using Red Hat Build of Keycloak with FGAP V2 enabled.

Patch status is not yet confirmed — check the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-18571 for current remediation guidance. Until an official fix is available, organizations should review and restrict sub-administrator permissions carefully, especially regarding user creation and group assignment capabilities, to minimize risk.