CVE-2026-14209

Description

A vulnerability was discovered in Keycloak-s Admin UI extension that allows certain administrative users to bypass security restrictions. When Fine-Grained Admin Permissions (FGAPv2) are enabled, an administrator who should only be able to search for users (but not view their full details) can use a specific -brute-force-user- endpoint to access a user-s full profile. This includes sensitive information and security metadata. The issue occurs because the system fails to check if the administrator has the required -view- permission for that specific user when using this particular search path.