CVE-2026-14615

LowCVSS 2.7/10Last modified Oct 25, 2026

Description

A flaw was found in the Fine-Grained Admin Permissions (FGAP) v2 implementation within Keycloak's administrative services. When FGAP v2 is enabled, the system fails to properly filter child groups based on the caller's specific permissions when requested through a parent group. This allows a delegated administrator to view details of child groups they are not authorized to access directly, including group names, paths, and custom attributes.

Metrics

CVSS 3.1 2.7/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-1220

Affected software

Vendor	Product	Versions
Red Hat	Red Hat build of Keycloak 26.4	—
Red Hat	Red Hat build of Keycloak 26.4	—
Red Hat	Red Hat build of Keycloak 26.4	—
Red Hat	Red Hat build of Keycloak 26.4.14	—
Red Hat	Red Hat build of Keycloak 26.6	—
Red Hat	Red Hat build of Keycloak 26.6	—
Red Hat	Red Hat build of Keycloak 26.6	—
Red Hat	Red Hat build of Keycloak 26.6.5	—

References

https://access.redhat.com/errata/RHSA-2026:50846Vendor Advisory
https://access.redhat.com/errata/RHSA-2026:50847Vendor Advisory
https://access.redhat.com/errata/RHSA-2026:50848Vendor Advisory
https://access.redhat.com/errata/RHSA-2026:50849Vendor Advisory
https://access.redhat.com/security/cve/CVE-2026-14615Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2496891Issue Tracking, Vendor Advisory

Timeline

Published: Jul 3, 2026
Last modified: Oct 25, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-146173.1A security vulnerability has been detected in NousResearch hermes-agent up to 2026.4.30. Affected is the function GatewayStreamConsumer._fil CVE-2026-146184.3A vulnerability was detected in Open5GS up to 2.7.7. Affected by this vulnerability is the function amf_nnrf_handle_nf_discover of the file CVE-2026-146196.3A flaw has been found in itsourcecode Hospital Management System 1.0. Affected by this issue is some unknown functionality of the file /medi CVE-2026-14627.8A vulnerability in the `TFSMLayer` class of the `keras` package, version 3.13.0, allows attacker-controlled TensorFlow SavedModels to be loa CVE-2026-146204.7webpack-dev-server versions 5.2.5 and earlier expose two internal developer endpoints, /webpack-dev-server/open-editor and /webpack-dev-serv CVE-2026-146213.1A vulnerability has been found in FederatedAI FATE up to 2.2.0. This affects the function QueuePushReqStreamObserver.initEggroll of the file CVE-2026-146227.3A vulnerability was found in jairiidriss restaurant-website-php-mysql up to 521428b5b612449df0cf4a5d15ee40cba67f3d35. This vulnerability aff CVE-2026-146234.3A vulnerability was determined in omec-project amf up to 2.1.1. This issue affects the function RRCInactiveTransitionReport of the component CVE-2026-146244.3A vulnerability was identified in omec-project amf up to 2.0.2/2.1.1. Impacted is an unknown function of the file /go/src/amf/ngap/handler.g CVE-2026-146256.3A security flaw has been discovered in NousResearch hermes-agent up to 0.15.2. The affected element is the function shell.exec of the file t CVE-2026-146264.3A weakness has been identified in NousResearch hermes-agent up to 2026.4.30. The impacted element is the function AIAgent.run_conversation o CVE-2026-146275.6A security vulnerability has been detected in NousResearch hermes-agent up to 0.15.2. This affects the function DiscordAdapter._is_allowed_u