CVE-2026-14615
MEDIUM
NVD
CVSS Score
4.3
Severity
MEDIUM
Published
Jul 03, 2026
Vendor
unknown
Description
A flaw was found in the Fine-Grained Admin Permissions (FGAP) v2 implementation within Keycloak's administrative services. When FGAP v2 is enabled, the system fails to properly filter child groups based on the caller's specific permissions when requested through a parent group. This allows a delegated administrator to view details of child groups they are not authorized to access directly, including group names, paths, and custom attributes.