CVE-2026-14613 Red Hat CVE debrief

Who should care

Administrators and users of Keycloak, especially those with restricted administrative access, should be aware of this vulnerability and take necessary precautions to prevent unauthorized access to group information. This includes reviewing and updating Keycloak configurations to ensure proper permissions and access controls, monitoring for suspicious activity, and considering additional security measures such as role-based access control and auditing.

Technical summary

The vulnerability occurs when Fine-Grained Admin Permissions (FGAP v2) are enabled in Keycloak. An administrator with permission to view a specific role can also view a list of all groups assigned to that role, without having permission to see those groups. This could allow a restricted administrator to discover 'hidden' groups and view their details, such as internal names and custom settings, which may contain sensitive deployment information. The system fails to enforce proper access controls, allowing unauthorized access to group information.

Defensive priority

Medium priority, as the vulnerability has a CVSS score of 4.3 and is classified as MEDIUM severity. Defenders should prioritize reviewing and updating Keycloak configurations, monitoring for suspicious activity, and implementing additional security measures to prevent unauthorized access to group information.

Recommended defensive actions

• Review and update Keycloak configurations to ensure proper permissions and access controls.
• Monitor for any suspicious activity or unauthorized access to group information.
• Consider implementing additional security measures, such as role-based access control and auditing.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.

Evidence notes

The CVE record was published on 2026-07-03T16:16:55.527Z and last modified on 2026-07-07T18:16:35.023Z. The NVD entry is currently Awaiting Analysis. This information is based on the supplied source corpus and may not reflect the current status of the vulnerability. Defenders should verify the current status and scope of the vulnerability with the official CVE record and NVD entry. The vulnerability affects Keycloak's administrative interface, specifically when Fine-Grained Admin Permissions (FGAP v2) are enabled. The system fails to check if an administrator has permission to see specific groups, allowing certain administrators to see information about groups they shouldn't have access to.

Official resources