A vulnerability was discovered in Keycloak's administrative interface that allows certain administrators to see information about groups they shouldn'...
Original description
The description as published by the source.
A vulnerability was discovered in Keycloak's administrative interface that allows certain administrators to see information about groups they shouldn't have access to. When the new Fine-Grained Admin Permissions (FGAP v2) are turned on, an administrator who is allowed to see a specific "role" can also see a list of all groups assigned to that role. The system fails to check if the administrator has permission to see those specific groups. This could allow a restricted administrator to discover "hidden" groups and see their details, such as internal names and custom settings, which might contain sensitive deployment information.
Source: OSV.dev (Open Source Vulnerabilities) OSV
Affected packages
References
- report ubuntu.com
- report cve.org
- report access.redhat.com
- report bugzilla.redhat.com