CVE-2026-14615: Keycloak-services: keycloak: fgap v2 parent group children endpoint bypasses per-child view permission filter
A flaw was found in the Fine-Grained Admin Permissions (FGAP) v2 implementation within Keycloak's administrative services. When FGAP v2 is enabled, the system fails to properly filter child groups based on the caller's specific permissions when requested through a parent group. This allows a delegated administrator to view details of child groups they are not authorized to access directly, including group names, paths, and custom attributes.
Other sources
An authorization bypass vulnerability exists in the GroupResource.getSubGroups() function of org.keycloak.services.resources.admin. The issue stems from a logic error where the auth.groups()::canView filter is only applied when the legacy permission schema is active. Under FGAP v2, AdminPermissionsSchema.SCHEMA.isAdminPermissionsEnabled(realm) returns true, causing the filter to be skipped. An attacker with a delegated admin role and Groups:view permission on a parent group can exploit this by calling the .../groups/{parentGroupId}/children endpoint. Successful exploitation allows the attacker to: Enumerate hidden child groups under the parent group.
Disclose child group UUIDs, names, and paths.
Access subgroup counts and custom attributes of unauthorized child groups.
Confirm the bypass via the access.view=false flag returned in the unauthorized data.
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-14615?
CVE-2026-14615 has a medium severity rating of 4.3.
How do I fix CVE-2026-14615?
To fix CVE-2026-14615, ensure that FGAP v2 is properly configured to enforce child group view permissions.
What software is affected by CVE-2026-14615?
CVE-2026-14615 affects the Keycloak Admin Services under the keycloak: keycloak-services component.
What is the impact of CVE-2026-14615?
CVE-2026-14615 allows users to bypass view permission filters for child groups under a parent group.
When was CVE-2026-14615 published?
CVE-2026-14615 was published on July 3, 2026.