CVE-2026-14614

Low

No strong exploitation signal.

CVSS base

5.4 MEDIUM

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

EPSS — probability of exploitation (30 days)

0.3%

24.7th percentile

CISA KEV

Not listed

Weakness / dates

CWE-284

Published 2026-07-03 · modified 2026-08-11

CVSS breakdown

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Attack Vector	N	Network
Attack Complexity	L	Low
Privileges Required	L	Low
User Interaction	N	None
Scope	U	Unchanged
Confidentiality	L	Low
Integrity	L	Low
Availability	N	None

Timeline

2026-07-03 — Published (NVD)
2026-08-11 — Last modified (NVD)

Description

A flaw was found in the ClientResource component of Keycloak's admin services when Fine-Grained Admin Permissions (FGAP) v2 is enabled. This issue allows a delegated administrator, who should only have limited control over specific clients, to attach or remove hidden client scopes that they are not authorized to see or manage. As a result, an attacker could inject unauthorized data or permissions into the security tokens issued to end-users, potentially tricking other applications into granting higher levels of access than intended.

Affected

redhat

References

Official: NVD · CVE.org