CVE-2026-14209: Keycloak-admin-ui: keycloak-admin-ui:admin ui extension brute-force-user endpoint bypasses fgapv2 user view restrictions
A flaw was found in the Keycloak Admin UI extension. The GET /admin/realms/{realm}/ui-ext/brute-force-user?search=id:{userId} endpoint fails to correctly enforce Fine-Grained Admin Permissions v2 (FGAPv2) user view restrictions. Specifically, the BruteForceUsersResource.java component skips the usersEvaluator::canView filter when processing the search=id: code path. An authenticated attacker with the query-users client role from realm-management can exploit this vulnerability to retrieve full user representations, including Personally Identifiable Information (PII) and brute-force metadata, for any user whose ID they know or can obtain. This bypasses the intended restriction where such an admin should only be able to view users they have explicit view permissions for under FGAPv2.
Other sources
A vulnerability was discovered in Keycloak's Admin UI extension that allows certain administrative users to bypass security restrictions. When Fine-Grained Admin Permissions (FGAPv2) are enabled, an administrator who should only be able to search for users (but not view their full details) can use a specific "brute-force-user" endpoint to access a user's full profile. This includes sensitive information and security metadata. The issue occurs because the system fails to check if the administrator has the required "view" permission for that specific user when using this particular search path.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Ensure the brute-force-user endpoint (BruteForceUsersResource.java search=id: path) correctly applies the usersEvaluator::canView filter / FGAPv2 user view permission check for the target user before returning the user representation.
Keycloak Admin UI extension FGAPv2 user view enforcement for GET /admin/realms/{realm}/ui-ext/brute-force-user?search=id:{userId} = enforced
Event History
Frequently Asked Questions
What is the severity of CVE-2026-14209?
The severity of CVE-2026-14209 is medium, rated at 4.3.
What does CVE-2026-14209 affect?
CVE-2026-14209 affects the Keycloak Admin UI extension.
How do I fix CVE-2026-14209?
To fix CVE-2026-14209, ensure that Fine-Grained Admin Permissions (FGAPv2) are properly configured and restrict access as needed.
Who is affected by CVE-2026-14209?
CVE-2026-14209 affects administrative users of Keycloak who may bypass user view restrictions.
What potential impact does CVE-2026-14209 have?
CVE-2026-14209 can lead to unauthorized viewing of user details by administrators, compromising user privacy.