CVE-2026-15945

Name of the Vulnerable Software and Affected Versions Keycloak server (affected versions not specified)

Description A flaw exists in the group search functionality of the administrative API. When Fine-Grained Admin Permissions (FGAP) v2 is enabled, a delegated administrator can bypass access restrictions to view parent groups they are not authorized to access. By searching for a child group they have permission to view, the system incorrectly returns the full details of the parent group in the response, resulting in the disclosure of sensitive group attributes and configuration.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.