AIKIDO-2026-970969
keycloak-services is vulnerable to Authorization Bypass
43
Medium Risk
This Affects:
keycloak-servicesTL;DR
Under Fine-Grained Admin Permissions v2, the parent group's children listing endpoint does not filter child groups by the caller's per-child view permissions. A delegated admin who can access a parent group can enumerate child groups they are not authorized to view, including names, paths, and custom attributes. The fix applies the per-child view permission filter on that endpoint.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and use Fine-Grained Admin Permissions v2 to restrict which admins can view groups in a hierarchy.
Background info
keycloak-services is vulnerable to Authorization Bypass in versions 26.2.0 - 26.7.0.
How to fix this
Upgrade the org.keycloak:keycloak-services library to the patch version.
Links
GitHub Release
Other
access.redhat.com/errata/RHSA-2026:50846access.redhat.com/errata/RHSA-2026:50847access.redhat.com/errata/RHSA-2026:50848access.redhat.com/errata/RHSA-2026:50849access.redhat.com/security/cve/CVE-2026-14615bugzilla.redhat.com/show_bug.cgi?id=2496891
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant