Vulnerability Report

CVE-2026-15945

Title: Access Restriction Bypass in Keycloak Group Search API

Auth Bypass

Proof Of Concept

No public PoC currently indexed for CVE-2026-15945.

CWE Category CWE-639

Published Date Jul 16, 2026

Modified Date Sep 16, 2026

Exploit Status Not Found

Score 4.3 CVSS v3.1

Exploit Probability (EPSS)

0.35%

Vulnerability Summary

CVE-2026-15945: A flaw was found in the group search functionality of the Keycloak server's administrative API. When Fine-Grained Admin Permissions (FGAP) v2 is enabled, a delegated administrator can bypass access restrictions to view parent groups they are not authorized to see. By searching for a child group they have permission to view, the system incorrectly returns the full details of the parent group in the response, leading to the disclosure of sensitive group attributes and configuration.

Impacted Vendors

redhat 4

pivotal 1

Reference Links

https://access.redhat.com/security/cve/CVE-2026-15945 https://bugzilla.redhat.com/show_bug.cgi?id=2501302

CVSS v3.1

Source Entity [email protected]

Severity MEDIUM

4.3

Attack Vector

NETWORK

Complexity

LOW

Privileges

N/A

Interaction

NONE

Confidentiality

N/A

Integrity

N/A

Availability

N/A

Scope

UNCHANGED

RAW VECTOR CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N