← לוח פגיעויות

CVE-2026-14613

בינונית 4.9

תיאור (מקור, אנגלית)

A vulnerability was discovered in Keycloak's administrative interface that allows certain administrators to see information about groups they shouldn't have access to. When the new Fine-Grained Admin Permissions (FGAP v2) are turned on, an administrator who is allowed to see a specific "role" can also see a list of all groups assigned to that role. The system fails to check if the administrator has permission to see those specific groups. This could allow a restricted administrator to discover "hidden" groups and see their details, such as internal names and custom settings, which might contain sensitive deployment information.

מדדים

CVSS 3.1
4.9 (MEDIUM) מקור הציון: NVD CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
EPSS — סבירות ניצול
0% (אחוזון 000) נכון ל-16/8/2026
CWE
CWE-284

מוצרים מושפעים

redhat: build of keycloak

קישורים