Описание
A vulnerability was discovered in Keycloak's Admin UI extension that allows certain administrative users to bypass security restrictions. When Fine-Grained Admin Permissions (FGAPv2) are enabled, an administrator who should only be able to search for users (but not view their full details) can use a specific "brute-force-user" endpoint to access a user's full profile. This includes sensitive information and security metadata. The issue occurs because the system fails to check if the administrator has the required "view" permission for that specific user when using this particular search path.
Отчет
The Red Hat Product Security team has assessed the severity of this vulnerability as Moderate, given that it requires the attacker to already possess administrative privileges (query-users role) and knowledge of the target user's ID. Successful exploitation allows an attacker to bypass fine-grained authorization controls to view sensitive user data they are not authorized to see. The vulnerability's root cause is a missing authorization check in the BruteForceUsersResource component of the Admin UI extension.
Меры по смягчению последствий
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat JBoss Enterprise Application Platform Expansion Pack | keycloak-admin-ui | Fix deferred | ||
| Red Hat build of Keycloak 26.4 | rhbk/keycloak-operator-bundle | Fixed | RHSA-2026:50847 | 05.08.2026 |
| Red Hat build of Keycloak 26.4 | rhbk/keycloak-rhel9 | Fixed | RHSA-2026:50847 | 05.08.2026 |
| Red Hat build of Keycloak 26.4 | rhbk/keycloak-rhel9-operator | Fixed | RHSA-2026:50847 | 05.08.2026 |
| Red Hat build of Keycloak 26.4.14 | keycloak-admin-ui | Fixed | RHSA-2026:50846 | 05.08.2026 |
| Red Hat build of Keycloak 26.4.14 | rhbk-openshift-rhel9/rhbk-openshift-rhel9 | Fixed | RHSA-2026:50846 | 05.08.2026 |
| Red Hat build of Keycloak 26.6 | rhbk/keycloak-operator-bundle | Fixed | RHSA-2026:50849 | 05.08.2026 |
| Red Hat build of Keycloak 26.6 | rhbk/keycloak-rhel9 | Fixed | RHSA-2026:50849 | 05.08.2026 |
| Red Hat build of Keycloak 26.6 | rhbk/keycloak-rhel9-operator | Fixed | RHSA-2026:50849 | 05.08.2026 |
| Red Hat build of Keycloak 26.6.5 | keycloak-admin-ui | Fixed | RHSA-2026:50848 | 05.08.2026 |
Показывать по
Дополнительная информация
Статус:
EPSS
4.3 Medium
CVSS3
Связанные уязвимости
A vulnerability was discovered in Keycloak's Admin UI extension that allows certain administrative users to bypass security restrictions. When Fine-Grained Admin Permissions (FGAPv2) are enabled, an administrator who should only be able to search for users (but not view their full details) can use a specific "brute-force-user" endpoint to access a user's full profile. This includes sensitive information and security metadata. The issue occurs because the system fails to check if the administrator has the required "view" permission for that specific user when using this particular search path.
A vulnerability was discovered in Keycloak's Admin UI extension that a ...
A vulnerability was discovered in Keycloak's Admin UI extension that allows certain administrative users to bypass security restrictions. When Fine-Grained Admin Permissions (FGAPv2) are enabled, an administrator who should only be able to search for users (but not view their full details) can use a specific "brute-force-user" endpoint to access a user's full profile. This includes sensitive information and security metadata. The issue occurs because the system fails to check if the administrator has the required "view" permission for that specific user when using this particular search path.
ALT-PU-2026-13025: package `keycloak` update to version 26.7.1-alt1
ALT-PU-2026-12509: package `keycloak` update to version 26.7.1-alt1
EPSS
4.3 Medium
CVSS3