CVE-2026-14613

The record

A vulnerability was discovered in Keycloak's administrative interface that allows certain administrators to see information about groups they shouldn't have access to. When the new Fine-Grained Admin Permissions (FGAP v2) are turned on, an administrator who is allowed to see a specific "role" can also see a list of all groups assigned to that role. The system fails to check if the administrator has permission to see those specific groups. This could allow a restricted administrator to discover "hidden" groups and see their details, such as internal names and custom settings, which might contain sensitive deployment information.

Affected packages

Related vulnerabilities

• CVE-2026-96372 Insufficient Granularity of Access Control vulnerability in Drupal Webform allows… CWE-1220
• CVE-2026-78230 AshAi exposes Ash read actions to language-model tool calls. CWE-1220
• CVE-2026-78216 AshLua exposes Ash read actions to Lua scripts run through an eval action. CWE-1220
• CVE-2026-15431 A potential security vulnerability has been identified in the HP Support Assistant for… CWE-1220
• CVE-2026-40145 A vulnerability exists in the interaction between a Endpoint Privilege Management… CWE-1220
• CVE-2025-31938 Insufficient granularity of access control in some subsystem for some Intel(R) Xeon(R) 6… CWE-1220
• CVE-2026-50502 Insufficient granularity of access control in Windows Event Logging Service allows an… CWE-1220
• CVE-2026-50405 Insufficient granularity of access control in Windows Filtering Platform (WFP) allows an… CWE-1220