REDHAT-BUG-2501740: Medium severity Keycloak Keycloak Admin REST API vulnerability
A flaw was found in the Keycloak Admin REST API when Fine-Grained Admin Permissions (FGAP) v2 is enabled. The default-groups endpoint and the general realm representation do not correctly enforce per-group view permission checks for default groups. A delegated administrator who has been granted realm-level view permissions but is explicitly denied view permissions for specific groups can still enumerate those hidden groups. By accessing the admin/realms/{realm}/default-groups or admin/realms/{realm} endpoints, the attacker can recover group names, UUIDs, and paths. This allows an authenticated attacker to map out the authorization topology, including onboarding structures, privilege levels, or tenant information that should remain restricted.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
If Fine-Grained Admin Permissions (FGAP) v2 is enabled, restrict access to the Keycloak Admin REST API endpoints /admin/realms/{realm}/default-groups and /admin/realms/{realm} to only principals that require realm-level access; do not allow delegated admins with realm-level view permissions to call these endpoints unless they also have appropriate per-group view permissions.
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-2501740?
The severity of REDHAT-BUG-2501740 is classified as medium with a score of 4.
What is the main issue with REDHAT-BUG-2501740?
The main issue with REDHAT-BUG-2501740 is the lack of proper enforcement of per-group view permission checks in the Keycloak Admin REST API when Fine-Grained Admin Permissions v2 is enabled.
How do I fix REDHAT-BUG-2501740?
To fix REDHAT-BUG-2501740, ensure that appropriate permission checks are implemented for the default-groups endpoint in your Keycloak configuration.
What product does REDHAT-BUG-2501740 affect?
REDHAT-BUG-2501740 affects the Keycloak Admin REST API.
What are the implications of REDHAT-BUG-2501740?
The implications of REDHAT-BUG-2501740 include potential unauthorized access to group information by delegated administrators.