Security Flaw in Keycloak's Fine-Grained Admin Permissions for ClientResource
CVE-2026-14614

5.4MEDIUM

Key Information:

Vendor

Red Hat
Status
Red Hat Build Of Keycloak
Red Hat Data Grid 8
Red Hat Jboss Enterprise Application Platform Expansion Pack
Red Hat Single Sign-on 7
Vendor
CVE Published:
3 July 2026

What is CVE-2026-14614?

A security vulnerability has been identified in the ClientResource component of Keycloak's admin services when Fine-Grained Admin Permissions (FGAP) v2 is enabled. This flaw permits delegated administrators, who should only have limited access to specific clients, to manipulate hidden client scopes beyond their authorized visibility. Consequently, attackers could inject unauthorized data or permissions into the security tokens issued to users, thereby misleading other applications into granting elevated access rights that exceed the intended authorization.

References

https://access.redhat.com/security/cve/CVE-2026-14614
vdb-entryx_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2496889
issue-trackingx_refsource_REDHAT

CVSS V3.1

Score:
5.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.