Is CVE-2026-14615 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-14615 being exploited in the wild.

How severe is CVE-2026-14615?

Medium severity, with a CVSS score of 4.3, published 3 July 2026.

Which products and versions are affected?

Red Hat Keycloak FGAP v2 enabled; Red Hat Red Hat Build of Keycloak.

Is there a fix for CVE-2026-14615?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-14615 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-14615?

Check whether you run Red Hat build of Keycloak. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-14615: Red Hat Keycloak authorization bypass in FGAP v2 child group endpoint

CVE-2026-14615 · Severity: medium · CVSS 4.3 · Published 2026-07-03

A security flaw was identified in Keycloak, a popular identity and access management solution. When specific advanced administrative permissions are enabled, the system fails to properly restrict what delegated administrators can see. This allows an administrator who should only have limited access to view sensitive details about user groups they are not authorized to manage, including group names, internal paths, and custom configuration attributes.

Technologies: Red Hat build of Keycloak. Vendors: Red Hat.

Quick answers

Is CVE-2026-14615 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-14615 being exploited in the wild.
How severe is CVE-2026-14615?: Medium severity, with a CVSS score of 4.3, published 3 July 2026.
Which products and versions are affected?: Red Hat Keycloak FGAP v2 enabled; Red Hat Red Hat Build of Keycloak.
Is there a fix for CVE-2026-14615?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-14615 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-14615?: Check whether you run Red Hat build of Keycloak. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An authorization bypass exists in the `GroupResource.getSubGroups()` function within `org.keycloak.services.resources.admin`. The vulnerability is caused by a logic error where the `auth.groups()::canView` filter is bypassed when Fine-Grained Admin Permissions (FGAP) v2 is enabled. An attacker with a delegated admin role and `Groups:view` permissions on a parent group can access the `/groups/{parentGroupId}/children` endpoint to enumerate hidden child groups. This exposure includes group UUIDs, names, paths, subgroup counts, and custom attributes that the caller is not authorized to access directly.

Affected products

Red Hat Keycloak FGAP v2 enabled
Red Hat Red Hat Build of Keycloak

Timeline

2026-07-03: disclosed
2026-07-03: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.