AIKIDO-2026-609840
keycloak-services is vulnerable to Authorization Bypass
45
Medium Risk
This Affects:
keycloak-servicesTL;DR
Under Fine-Grained Admin Permissions v2, the role-to-group mapping enumeration in RoleContainerResource checks that the caller can view the role but does not check per-group view permission for groups assigned to that role. A delegated admin who can view a role can therefore list hidden groups mapped to it and read their names, paths, and custom attributes. The fix enforces group view permissions when returning those role-group mappings.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and use Fine-Grained Admin Permissions v2 to restrict which admins can view groups.
Background info
keycloak-services is vulnerable to Authorization Bypass in versions 26.2.0 - 26.7.1.
How to fix this
Upgrade the org.keycloak:keycloak-services library to the patch version.
Links
GitHub Release
Other
access.redhat.com/errata/RHSA-2026:56523access.redhat.com/errata/RHSA-2026:56524access.redhat.com/security/cve/CVE-2026-14613bugzilla.redhat.com/show_bug.cgi?id=2496878
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant