Description
A flaw was found in the user creation component of Keycloak when Fine-Grained Admin Permissions V2 (FGAP V2) is enabled. This issue allows a sub-administrator with permission to create users to add those users to any group, even groups the sub-administrator is not authorized to manage. This could lead to unauthorized access to sensitive information or elevated privileges for the newly created users.
Metrics
CVSS 3.1 7.2/10
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:HWeakness enumeration
Affected software
| Vendor | Product | Versions |
|---|---|---|
| Red Hat | Red Hat build of Keycloak 26.6 | — |
| Red Hat | Red Hat build of Keycloak 26.6 | — |
| Red Hat | Red Hat build of Keycloak 26.6 | — |
| Red Hat | Red Hat build of Keycloak 26.6.7 | — |
| Red Hat | Red Hat build of Keycloak 26.6.7 | — |
| Red Hat | Red Hat build of Keycloak 26.6.7 | — |
| Red Hat | Red Hat Data Grid 8 | — |
| Red Hat | Red Hat JBoss Enterprise Application Platform Expansion Pack | — |
| Red Hat | Red Hat Single Sign-On 7 | — |
References
Timeline
- Published
- Aug 2, 2026
- Last modified
- Sep 16, 2026
- NVD status
- Modified