REDHAT-BUG-2496891: Medium severity Keycloak Keycloak vulnerability

Published Jul 3, 2026

Updated

An authorization bypass vulnerability exists in the GroupResource.getSubGroups() function of org.keycloak.services.resources.admin. The issue stems from a logic error where the auth.groups()::canView filter is only applied when the legacy permission schema is active. Under FGAP v2, AdminPermissionsSchema.SCHEMA.isAdminPermissionsEnabled(realm) returns true, causing the filter to be skipped. An attacker with a delegated admin role and Groups:view permission on a parent group can exploit this by calling the .../groups/{parentGroupId}/children endpoint. Successful exploitation allows the attacker to: Enumerate hidden child groups under the parent group.

Disclose child group UUIDs, names, and paths.

Access subgroup counts and custom attributes of unauthorized child groups.

Confirm the bypass via the access.view=false flag returned in the unauthorized data.

Affected Software

1 affected component

Keycloak Keycloak

Event History

Jul 3, 2026

Data Sourced

via Red Hat·03:30 PM

DescriptionSeverityAffected Software

Frequently Asked Questions

What is the severity of REDHAT-BUG-2496891?

The severity of REDHAT-BUG-2496891 is rated as medium with a score of 4.

How do I fix REDHAT-BUG-2496891?

To fix REDHAT-BUG-2496891, ensure that the authorization logic is correctly applied regardless of the permission schema in use.

What causes the REDHAT-BUG-2496891 vulnerability?

REDHAT-BUG-2496891 is caused by a logic error in the GroupResource.getSubGroups() function where permission filtering is only applied under legacy permission schema.

What components are affected by REDHAT-BUG-2496891?

REDHAT-BUG-2496891 affects the Keycloak application, specifically the authorization feature in its admin resources.

What potential impact does REDHAT-BUG-2496891 have?

The impact of REDHAT-BUG-2496891 could allow unauthorized users to access subgroup information they should not be able to view.