Medium [CVE-2026-18571] FGAP V2 group assignment bypass during user creation

A flaw was found in the user creation component of Keycloak when Fine-Grained Admin Permissions V2 (FGAP V2) is enabled. This issue allows a sub-administrator with permission to create users to add those users to any group, even groups the sub-administrator is not authorized to manage.

This could lead to unauthorized access to sensitive information or elevated privileges for the newly created users.

The Red Hat Product Security team has assessed the severity of this vulnerability as Moderate, given that it requires the non-default Fine-Grained Admin Permissions V2 to be enabled and the attacker must already possess high-level sub-administrator privileges.

Successful exploitation allows an attacker to bypass group membership restrictions during user creation, potentially leading to unauthorized privilege escalation for new users. The vulnerability's root cause is a missing authorization check for group assignments within the user creation API payload.

Weakness: CWE-862. Affected Red Hat products: Red Hat build of Keycloak 26.6; Red Hat build of Keycloak 26.6.7.

Red Hat lists Red Hat Data Grid 8; Red Hat JBoss Enterprise Application Platform Expansion Pack; Red Hat Single Sign-On 7 as not affected. Red Hat fixing advisory: RHSA-2026:68277, RHSA-2026:68278.