CVE-2026-18571: Keycloak-services: keycloak-services: fgap v2 group assignment bypass during user creation

Severity: high (CVSS 7.2 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.5% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-08-02 · updated 2026-09-16
Weakness: CWE-862

Description

A flaw was found in the user creation component of Keycloak when Fine-Grained Admin Permissions V2 (FGAP V2) is enabled. This issue allows a sub-administrator with permission to create users to add those users to any group, even groups the sub-administrator is not authorized to manage. This could lead to unauthorized access to sensitive information or elevated privileges for the newly created users.

Affected products

Red Hat build of Keycloak 26.4: all versions

References

https://access.redhat.com/errata/RHSA-2026:68277
https://access.redhat.com/errata/RHSA-2026:68278
https://access.redhat.com/security/cve/CVE-2026-18571
https://bugzilla.redhat.com/show_bug.cgi?id=2509759

Get alerted when CVE-2026-18571 or the next vulnerability affects your stack