CVE-2026-14209

Name of the Vulnerable Software and Affected Versions Keycloak (affected versions not specified)

Description An issue in the Admin UI extension allows administrative users to bypass security restrictions when Fine-Grained Admin Permissions (FGAPv2) are enabled. An administrator with permissions limited to searching for users can access a user's full profile, including sensitive information and security metadata, by using the brute-force-user endpoint. This occurs because the system does not verify if the administrator possesses the necessary view permission for the specific user when accessing this endpoint.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability. Restrict access to the brute-force-user endpoint to minimize the risk of exploitation.