CVE-2026-18571

HighCVSS 7.2/10Last modified Sep 16, 2026

Description

A flaw was found in the user creation component of Keycloak when Fine-Grained Admin Permissions V2 (FGAP V2) is enabled. This issue allows a sub-administrator with permission to create users to add those users to any group, even groups the sub-administrator is not authorized to manage. This could lead to unauthorized access to sensitive information or elevated privileges for the newly created users.

Metrics

CVSS 3.1 7.2/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-862

Affected software

No affected versions have been published.

Timeline

Published: Aug 2, 2026
Last modified: Sep 16, 2026
NVD status: Modified

Related CVEs from 2026

CVE-2026-185726.5Keycloak provides authorization services that allow administrators to restrict access to resources based on time policies (for example, only CVE-2026-185736.5A flaw was found in the keycloak-services component of Keycloak, which is used for managing authentication and authorization flows. The issu CVE-2026-185749.3An authentication bypass vulnerability in Check Point Security Management Server and Multi-Domain Security Management Server (MDS) could all CVE-2026-185778.1An incomplete patch for CVE-2026-18556 allows for authentication bypass and account takeover in N-central Versions through 2026.3.1 CVE-2026-185797.2The WP Photo Album Plus plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'HTTP_X_FORWARDED_FOR' parameter in all ve CVE-2026-18584.8wget2 accepts a server certificate with incorrect Key Usage (KU) or Extended Key Usage (EKU). If the attackers compromise a certificate (wit CVE-2026-185813.3A vulnerability was determined in ggml-org llama.cpp e15efe0. Affected by this issue is some unknown functionality of the file common/jinja/CVE-2026-185825.3A security flaw has been discovered in mz-automation libiec61850 up to 1.6.1. This vulnerability affects the function Reporting_RCBWriteAcce CVE-2026-185835.3A weakness has been identified in mz-automation libiec61850 up to 1.6.1. This issue affects the function checkDataSetAccess of the file src/CVE-2026-185845.4A security vulnerability has been detected in GL.iNet E5800, E750, X2000, X3000, XE3000 and XE300 up to 20260707. Impacted is an unknown fun CVE-2026-185854.3A vulnerability was detected in GL.iNet MT3000, MT6000, BE9300, BE3600, MT3600BE, E5800, BE6500, MT5000, X3000, XE3000 and MT2500 up to 2026 CVE-2026-185867.2The Premium Packages – Sell Digital Products Securely plugin for WordPress is vulnerable to Unauthenticated Stored Cross-Site Scripting via