Keycloak: Schwachstelle ermöglicht Offenlegung von Informationen

Summary

Product

Vulnerabilities 1

• Medium 4.3
  CVE-2026-15945

  Keycloak-services: keycloak-services: group hierarchy search discloses hidden parent groups under fgap v2

  A flaw was found in the group search functionality of the Keycloak server's administrative API. When Fine-Grained Admin Permissions (FGAP) v2 is enabled, a delegated administrator can bypass access restrictions to view parent groups they are not authorized to…

  Red Hat Red Hat Single Sign-On 7 Red Hat JBoss Enterprise Application Platform Expansion Pack Red Hat build of Keycloak 26.6
  Jul 16, 2026

Revision history

1. 2026-09-16 #3

   Neue Updates von Red Hat aufgenommen

2. 2026-08-18 #2

   Neue Updates aufgenommen

3. 2026-07-16 #1

   Initiale Fassung

References

• GitHub Security Advisory vom 2026-07-16
  https://github.com/advisories/GHSA-HP9P-WJ8M-C339
• Red Hat Bugtracker 2501302 vom 2026-07-16
  https://bugzilla.redhat.com/show_bug.cgi?id=2501302
• Red Hat Customer Portal vom 2026-07-16
  https://access.redhat.com/security/cve/cve-2026-15945
• Keycloak 26.7.2 release vom 2026-08-19
  https://www.keycloak.org/2026/08/keycloak-2672-released
• Red Hat Security Advisory RHSA-2026:68277 vom 2026-09-16
  https://access.redhat.com/errata/RHSA-2026:68277
• Red Hat Security Advisory RHSA-2026:68278 vom 2026-09-16
  https://access.redhat.com/errata/RHSA-2026:68278