CVE-2026-14613: redhat build_of_keycloak

Vulnerability summary

CVE-2026-14613 is a medium (CVSS 4.9) vulnerability in redhat build_of_keycloak. EPSS estimates a 0.38% chance of exploitation in the next 30 days, higher than 30.2% of scored vulnerabilities.

Timeline

1. 03-07-2026
   PublishedVulnerability first disclosed.
2. 31-08-2026
   Last modifiedVulnerability information updated.

Description

A vulnerability was discovered in Keycloak's administrative interface that allows certain administrators to see information about groups they shouldn't have access to. When the new Fine-Grained Admin Permissions (FGAP v2) are turned on, an administrator who is allowed to see a specific "role" can also see a list of all groups assigned to that role. The system fails to check if the administrator has permission to see those specific groups. This could allow a restricted administrator to discover "hidden" groups and see their details, such as internal names and custom settings, which might contain sensitive deployment information.

• CWE-1220Insufficient Granularity of Access ControlThe product implements access controls via a policy or other feature with the intention to disable or restrict accesses (reads and/or writes) to assets in a system from untrusted agents. However, implemented access controls lack required granularity, which renders the control policy too broad because it allows accesses from unauthorized agents to the security-sensitive assets.
• CWE-284Improper Access ControlThe product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.