https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 03 Oct 2026 10:31:50 +0000 https://cve.radiocsirt.org/vuln/bit-keycloak-2026-18571 <p><strong>Affected:</strong> Bitnami: keycloak</p> <p>A flaw was found in the user creation component of Keycloak when Fine-Grained Admin Permissions V2 (FGAP V2) is enabled. This issue allows a sub-administrator with permission to create users to add those users to any group, even groups the sub-administrator is not authorized to manage. This could lead to unauthorized access to sensitive information or elevated privileges for the newly created users.</p> <p><strong>Affected:</strong> Bitnami: keycloak</p> <p>A flaw was found in the user creation component of Keycloak when Fine-Grained Admin Permissions V2 (FGAP V2) is enabled. This issue allows a sub-administrator with permission to create users to add those users to any group, even groups the sub-administrator is not authorized to manage. This could lead to unauthorized access to sensitive information or elevated privileges for the newly created users.</p> https://cve.radiocsirt.org/vuln/bit-keycloak-2026-18571 https://cve.radiocsirt.org/vuln/cleanstart-2026-mz50851 <p><strong>Affected:</strong> CleanStart: keycloak</p> <p>Security vulnerability affects the keycloak package. A flaw was found in the user creation component of Keycloak when Fine-Grained Admin Permissions V2 (FGAP V2) is enabled.</p> <p><strong>Affected:</strong> CleanStart: keycloak</p> <p>Security vulnerability affects the keycloak package. A flaw was found in the user creation component of Keycloak when Fine-Grained Admin Permissions V2 (FGAP V2) is enabled.</p> https://cve.radiocsirt.org/vuln/cleanstart-2026-mz50851 https://cve.radiocsirt.org/vuln/euvd-2026-369922 EUVD-2026-369922 https://cve.radiocsirt.org/vuln/euvd-2026-369922 https://cve.radiocsirt.org/vuln/fkie_cve-2026-18571 <p>A flaw was found in the user creation component of Keycloak when Fine-Grained Admin Permissions V2 (FGAP V2) is enabled. This issue allows a sub-administrator with permission to create users to add those users to any group, even groups the sub-administrator is not authorized to manage. This could lead to unauthorized access to sensitive information or elevated privileges for the newly created users.</p> <p>A flaw was found in the user creation component of Keycloak when Fine-Grained Admin Permissions V2 (FGAP V2) is enabled. This issue allows a sub-administrator with permission to create users to add those users to any group, even groups the sub-administrator is not authorized to manage. This could lead to unauthorized access to sensitive information or elevated privileges for the newly created users.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-18571 https://cve.radiocsirt.org/vuln/ghsa-5vmc-qhfj-qxc3 <p>A flaw was found in the user creation component of Keycloak when Fine-Grained Admin Permissions V2 (FGAP V2) is enabled. This issue allows a sub-administrator with permission to create users to add those users to any group, even groups the sub-administrator is not authorized to manage. This could lead to unauthorized access to sensitive information or elevated privileges for the newly created users.</p> <p>A flaw was found in the user creation component of Keycloak when Fine-Grained Admin Permissions V2 (FGAP V2) is enabled. This issue allows a sub-administrator with permission to create users to add those users to any group, even groups the sub-administrator is not authorized to manage. This could lead to unauthorized access to sensitive information or elevated privileges for the newly created users.</p> https://cve.radiocsirt.org/vuln/ghsa-5vmc-qhfj-qxc3 https://cve.radiocsirt.org/vuln/rhsa-2026:68277 <p>keycloak-services: keycloak-services: Group hierarchy search discloses hidden parent groups under FGAP v2 keycloak-services: keycloak-services: Organization invitation link exposure allows unauthorized member creation keycloak-services: keycloak-services: Authorization codes can be retargeted to another client session keycloak-services: keycloak-services: Required signed-JWT assertion policy can be bypassed with unsigned assertion headers keycloak-services: keycloak-services: Authenticator config endpoint exposes raw reCAPTCHA secrets to view-only admins keycloak-services: keycloak-services: Missing per-role authorization on RoleContainerResource composite endpoints keycloak-services: keycloak-services: Incorrect authorization in admin role-composite deletion allows delegated admin to remove privileged child roles keycloak-services: keycloak-services: Realm default-group reads disclose hidden groups under FGAP v2 keycloak-services: keycloak-services: Information disclosure via role-users endpoint bypasses per-user view filter keycloak-services: keycloak-services: Privilege escalation via impersonation role allows takeover of realm administrator accounts resteasy-core: RESTeasy SourceProvider remote unauthenticated file read keycloak-services: keycloak-services: Generic identity-provider creation can bind brokers to organizations without manage-organizations keycloak-services: keycloak-services: OIDC redirect_uri fragment bypass in HTTP parameter pollution check keycloak-serv…</p> <p>keycloak-services: keycloak-services: Group hierarchy search discloses hidden parent groups under FGAP v2 keycloak-services: keycloak-services: Organization invitation link exposure allows unauthorized member creation keycloak-services: keycloak-services: Authorization codes can be retargeted to another client session keycloak-services: keycloak-services: Required signed-JWT assertion policy can be bypassed with unsigned assertion headers keycloak-services: keycloak-services: Authenticator config endpoint exposes raw reCAPTCHA secrets to view-only admins keycloak-services: keycloak-services: Missing per-role authorization on RoleContainerResource composite endpoints keycloak-services: keycloak-services: Incorrect authorization in admin role-composite deletion allows delegated admin to remove privileged child roles keycloak-services: keycloak-services: Realm default-group reads disclose hidden groups under FGAP v2 keycloak-services: keycloak-services: Information disclosure via role-users endpoint bypasses per-user view filter keycloak-services: keycloak-services: Privilege escalation via impersonation role allows takeover of realm administrator accounts resteasy-core: RESTeasy SourceProvider remote unauthenticated file read keycloak-services: keycloak-services: Generic identity-provider creation can bind brokers to organizations without manage-organizations keycloak-services: keycloak-services: OIDC redirect_uri fragment bypass in HTTP parameter pollution check keycloak-serv…</p> https://cve.radiocsirt.org/vuln/rhsa-2026:68277 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-2614 <p>Ein Angreifer kann mehrere Schwachstellen in Keycloak ausnutzen, um seine Privilegien zu erhöhen, Sicherheitsmaßnahmen zu umgehen, Daten zu manipulieren und sensible Informationen offenzulegen.</p> <p>Ein Angreifer kann mehrere Schwachstellen in Keycloak ausnutzen, um seine Privilegien zu erhöhen, Sicherheitsmaßnahmen zu umgehen, Daten zu manipulieren und sensible Informationen offenzulegen.</p> https://cve.radiocsirt.org/vuln/wid-sec-w-2026-2614