Executive brief
A security flaw was identified in Keycloak, a popular identity and access management solution. When specific advanced administrative permissions are enabled, the system fails to properly restrict what delegated administrators can see. This allows an administrator who should only have limited access to view sensitive details about user groups they are not authorized to manage, including group names, internal paths, and custom configuration attributes.
Technical details
An authorization bypass exists in the `GroupResource.getSubGroups()` function within `org.keycloak.services.resources.admin`. The vulnerability is caused by a logic error where the `auth.groups()::canView` filter is bypassed when Fine-Grained Admin Permissions (FGAP) v2 is enabled. An attacker with a delegated admin role and `Groups:view` permissions on a parent group can access the `/groups/{parentGroupId}/children` endpoint to enumerate hidden child groups. This exposure includes group UUIDs, names, paths, subgroup counts, and custom attributes that the caller is not authorized to access directly.
Affected products
- Red Hat Keycloak FGAP v2 enabled
- Red Hat Red Hat Build of Keycloak
Timeline
- 2026-07-03: disclosed
- 2026-07-03: advisory