CVE-2026-15945
⚪ Do wiadomości
Obejście ograniczeń dostępu w Keycloak pozwala na ujawnienie wrażliwych danych grup.
CVSS
4.3
EPSS
0.3%
Exploit
none
Vendor
redhat
Opis źródłowy (NVD)
A flaw was found in the group search functionality of the Keycloak server's administrative API. When Fine-Grained Admin Permissions (FGAP) v2 is enabled, a delegated administrator can bypass access restrictions to view parent groups they are not authorized to see. By searching for a child group they have permission to view, the system incorrectly returns the full details of the parent group in the response, leading to the disclosure of sensitive group attributes and configuration.
brak
Brak patcha
Źródła i daty
| Źródło | Wartość |
|---|---|
| NVD – CVSS | 4.3 |
| CISA KEV (aktywnie wykorzystywane) | Nie |
| FIRST EPSS (prawdopodobieństwo exploita) | 0.3% |
| Opublikowano (NVD) | 2026-07-16 18:16:42 UTC |
| Ostatnia modyfikacja (NVD) | 2026-09-16 16:17:03 UTC |
Referencje
- https://access.redhat.com/errata/RHSA-2026:68277 ([email protected])
- https://access.redhat.com/errata/RHSA-2026:68278 ([email protected])
- https://access.redhat.com/security/cve/CVE-2026-15945 ([email protected]) [Vendor Advisory]
- https://bugzilla.redhat.com/show_bug.cgi?id=2501302 ([email protected]) [Issue Tracking, Vendor Advisory]