ALT-PU-2026-14157: package keycloak update to version 26.7.2-alt1
Описание
This update upgrades keycloak to version 26.7.2-alt1.
Устраненные уязвимости9
Ссылки5
GHSA-3pjw-73gf-8qr5
https://github.com/advisories/GHSA-3pjw-73gf-8qr5GHSA-4gv3-mc9p-5wqc
https://github.com/advisories/GHSA-4gv3-mc9p-5wqcGHSA-5gvw-p9qm-jgwh
https://github.com/advisories/GHSA-5gvw-p9qm-jgwhGHSA-rcgg-9c38-7xpx
https://github.com/advisories/GHSA-rcgg-9c38-7xpxСвязанные уязвимости
ALT-PU-2026-13486: package `keycloak` update to version 26.7.2-alt1
A vulnerability was discovered in Keycloak's administrative interface that allows certain administrators to see information about groups they shouldn't have access to. When the new Fine-Grained Admin Permissions (FGAP v2) are turned on, an administrator who is allowed to see a specific "role" can also see a list of all groups assigned to that role. The system fails to check if the administrator has permission to see those specific groups. This could allow a restricted administrator to discover "hidden" groups and see their details, such as internal names and custom settings, which might contain sensitive deployment information.
A vulnerability was discovered in Keycloak's administrative interface that allows certain administrators to see information about groups they shouldn't have access to. When the new Fine-Grained Admin Permissions (FGAP v2) are turned on, an administrator who is allowed to see a specific "role" can also see a list of all groups assigned to that role. The system fails to check if the administrator has permission to see those specific groups. This could allow a restricted administrator to discover "hidden" groups and see their details, such as internal names and custom settings, which might contain sensitive deployment information.
A vulnerability was discovered in Keycloak's administrative interface that allows certain administrators to see information about groups they shouldn't have access to. When the new Fine-Grained Admin Permissions (FGAP v2) are turned on, an administrator who is allowed to see a specific "role" can also see a list of all groups assigned to that role. The system fails to check if the administrator has permission to see those specific groups. This could allow a restricted administrator to discover "hidden" groups and see their details, such as internal names and custom settings, which might contain sensitive deployment information.
A vulnerability was discovered in Keycloak's administrative interface ...