Medium [CVE-2026-14209] keycloak-admin-ui:Admin UI extension brute-force-user endpoint bypasses FGAPv2 user view restrictions

A vulnerability was discovered in Keycloak's Admin UI extension that allows certain administrative users to bypass security restrictions.

When Fine-Grained Admin Permissions (FGAPv2) are enabled, an administrator who should only be able to search for users (but not view their full details) can use a specific "brute-force-user" endpoint to access a user's full profile. This includes sensitive information and security metadata.

The issue occurs because the system fails to check if the administrator has the required "view" permission for that specific user when using this particular search path.

The Red Hat Product Security team has assessed the severity of this vulnerability as Moderate, given that it requires the attacker to already possess administrative privileges (query-users role) and knowledge of the target user's ID.

Successful exploitation allows an attacker to bypass fine-grained authorization controls to view sensitive user data they are not authorized to see. The vulnerability's root cause is a missing authorization check in the BruteForceUsersResource component of the Admin UI extension.

Weakness: CWE-639. Affected Red Hat products: Red Hat build of Keycloak 26.4; Red Hat build of Keycloak 26.4.14; Red Hat build of Keycloak 26.6; Red Hat build of Keycloak 26.6.5; Red Hat JBoss Enterprise Application Platform Expansion Pack.