HIGH

CVE-2026-18571

Redhat Build Of Keycloak 2026-08-02 CVSS v3.1

CVSS

7.2

Description

A flaw was found in the user creation component of Keycloak when Fine-Grained Admin Permissions V2 (FGAP V2) is enabled. This issue allows a sub-administrator with permission to create users to add those users to any group, even groups the sub-administrator is not authorized to manage. This could lead to unauthorized access to sensitive information or elevated privileges for the newly created users.

Weakness (CWE)

CWE-862 Missing Authorization

EPSS Score

0.3%

Probability of exploitation in next 30 days

22.6th percentile

References

https://access.redhat.com/errata/RHSA-2026:68277 https://access.redhat.com/errata/RHSA-2026:68278 https://access.redhat.com/security/cve/CVE-2026-18571 Vendor Advisory https://bugzilla.redhat.com/show_bug.cgi?id=2509759 Issue Tracking, Vendor Advisory

View on dbcve.org

Base CVE data derived from NVD (public domain). Enrichment by dbcve.org (CC-BY-4.0). Fetched via API.

Back to CVE