Bug 2501302 (CVE-2026-15945)
| Summary: | CVE-2026-15945 keycloak-services: keycloak-services: Group hierarchy search discloses hidden parent groups under FGAP v2 | ||
|---|---|---|---|
| Product: | [Other] Security Response | Reporter: | OSIDB Bzimport <bzimport> |
| Component: | vulnerability | Assignee: | Product Security <prodsec-ir-bot> |
| Status: | NEW --- | QA Contact: | |
| Severity: | medium | Docs Contact: | |
| Priority: | medium | ||
| Version: | unspecified | CC: | anujha, aschwart, asoldano, aszczucz, bbaranow, bmaxwell, boliveir, bstansbe, dlofthou, drichtar, istudens, ivassile, iweiss, mosmerov, mposolda, msvehla, nwallace, pberan, pesilva, pjindal, pmackay, rmartinc, rstancel, ssilvert, sthorger, thjenkin, vdosoudi, vmuzikar |
| Target Milestone: | --- | Keywords: | Security |
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | --- | |
| Doc Text: |
A flaw was found in the group search functionality of the Keycloak server's administrative API. When Fine-Grained Admin Permissions (FGAP) v2 is enabled, a delegated administrator can bypass access restrictions to view parent groups they are not authorized to see. By searching for a child group they have permission to view, the system incorrectly returns the full details of the parent group in the response, leading to the disclosure of sensitive group attributes and configuration.
|
Story Points: | --- |
| Clone Of: | Environment: | ||
| Last Closed: | Type: | --- | |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
An information disclosure vulnerability exists in keycloak-services when Fine-Grained Admin Permissions (FGAP) v2 is enabled. The issue resides in the GET /admin/realms/{realm}/groups endpoint when the search parameter is used with briefRepresentation=false. The root cause is improper authorization filtering during the construction of the group hierarchy in the search results. While a delegated admin may be explicitly denied direct access to a parent group (resulting in a 403 Forbidden on direct GET requests), the search mechanism fails to redact the parent group's details when it is returned as part of the hierarchy for a visible child group. Exploitation Conditions: FGAP v2 must be enabled. The attacker must have an account with query-groups permissions. The attacker must have Groups:view permissions on at least one child group within a restricted parent group. Concrete Impact: An attacker can disclose the following information for unauthorized parent groups: Internal UUIDs and group names. Custom group attributes (which may contain sensitive metadata). Role mappings associated with the parent group.