CVE-2026-15945: Keycloak-services: keycloak-services: group hierarchy search discloses hidden parent groups under fgap v2
A flaw was found in the group search functionality of the Keycloak server's administrative API. When Fine-Grained Admin Permissions (FGAP) v2 is enabled, a delegated administrator can bypass access restrictions to view parent groups they are not authorized to see. By searching for a child group they have permission to view, the system incorrectly returns the full details of the parent group in the response, leading to the disclosure of sensitive group attributes and configuration.
Other sources
An information disclosure vulnerability exists in keycloak-services when Fine-Grained Admin Permissions (FGAP) v2 is enabled. The issue resides in the GET /admin/realms/{realm}/groups endpoint when the search parameter is used with briefRepresentation=false. The root cause is improper authorization filtering during the construction of the group hierarchy in the search results. While a delegated admin may be explicitly denied direct access to a parent group (resulting in a 403 Forbidden on direct GET requests), the search mechanism fails to redact the parent group's details when it is returned as part of the hierarchy for a visible child group. Exploitation Conditions: FGAP v2 must be enabled.
The attacker must have an account with query-groups permissions.
The attacker must have Groups:view permissions on at least one child group within a restricted parent group.
Concrete Impact: An attacker can disclose the following information for unauthorized parent groups: Internal UUIDs and group names.
Custom group attributes (which may contain sensitive metadata).
Role mappings associated with the parent group.
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Mitigate the information disclosure by disabling Fine-Grained Admin Permissions (FGAP) v2, since the vulnerability exists in keycloak-services when FGAP v2 is enabled (group hierarchy search discloses hidden parent groups).
Keycloak server administrative API (keycloak-services) Fine-Grained Admin Permissions (FGAP) v2 = disabled - Configuration
Avoid using the groups search with briefRepresentation=false on the GET /admin/realms/{realm}/groups endpoint, since the issue resides in this endpoint when the search parameter is used with briefRepresentation=false and results fail to redact hidden parent group details.
Keycloak server administrative API (GET /admin/realms/{realm}/groups) search parameter + briefRepresentation=false = avoid briefRepresentation=false when using search
Event History
Frequently Asked Questions
What is the severity of CVE-2026-15945?
The severity of CVE-2026-15945 is medium with a score of 4.3.
How do I fix CVE-2026-15945?
To fix CVE-2026-15945, ensure that Fine-Grained Admin Permissions (FGAP) v2 is properly configured to restrict group visibility.
What impact does CVE-2026-15945 have on Keycloak?
CVE-2026-15945 allows delegated administrators to see hidden parent groups, violating access restrictions.
Who is affected by CVE-2026-15945?
CVE-2026-15945 affects Keycloak users utilizing Fine-Grained Admin Permissions (FGAP) v2.
What version of Keycloak is impacted by CVE-2026-15945?
CVE-2026-15945 impacts the Keycloak server when FGAP v2 is enabled.