Executive brief
Keycloak, an open-source identity and access management solution, contains a flaw in its administrative interface. When specific advanced permission settings are enabled, a restricted administrator can view information about user groups they are not authorized to see. This could lead to the exposure of sensitive internal group names, organizational structures, and custom configuration settings.
Technical details
A vulnerability exists in Keycloak's Fine-Grained Admin Permissions v2 (FGAP v2) within the RoleContainerResource.getGroupsInRole() method. The administrative endpoints for retrieving groups assigned to a role (GET /admin/realms/{realm}/roles/{roleName}/groups and the client-specific equivalent) only verify that the requester has permission to view the role itself. They fail to perform a secondary check (auth.groups().canView(group)) for the individual groups returned. Consequently, an authenticated attacker with role-viewing privileges can enumerate 'hidden' groups and retrieve their metadata, including paths and custom attributes, bypassing intended group-level access controls.
Affected products
- Red Hat Red Hat Build of Keycloak Affected when Fine-Grained Admin Permissions (FGAP v2) is enabled
Timeline
- 2026-07-03: disclosed: Initial NVD publication and Red Hat advisory release