{"id":"CVE-2026-19608","aliases":["EUVD-2026-60581","GHSA-qxf7-g44v-fgwh"],"status":"published","title":"Keycloak-services: keycloak-services: name-only group claims let same-name groups satisfy path-specific group policies","description":"A flaw was found in the group policy provider of Keycloak authorization services, which is used to manage fine-grained access control to resources. The issue occurs when the system evaluates group-based policies using tokens that only contain group names rather than full paths. If two groups in different parts of the organization share the same name, a user in the unauthorized group can be mistaken for a member of the authorized group. This can allow a user to gain unauthorized access to protected resources they should not be able to reach.","severity":{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.0034,"percentile":0.27685,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-285"],"published":"2026-08-18T11:08:20Z","modified":"2026-11-06T17:34:15Z","products":[{"vendor":"red hat","product":"red hat build of keycloak 26.6"},{"vendor":"red hat","product":"red hat build of keycloak 26.6.8"},{"vendor":"red hat","product":"red hat single sign-on 7"}],"references":[{"url":"https://access.redhat.com/errata/RHSA-2026:95761","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:95762","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-19608","tags":["vdb-entry","x_refsource_REDHAT"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2514530","tags":["issue-tracking","x_refsource_REDHAT"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-19608"},{"url":"https://github.com/advisories/GHSA-qxf7-g44v-fgwh"}],"sources":{"cve":[{"id":"CVE-2026-19608","title":"Keycloak-services: keycloak-services: name-only group claims let same-name groups satisfy path-specific group policies","description":"A flaw was found in the group policy provider of Keycloak authorization services, which is used to manage fine-grained access control to resources. The issue occurs when the system evaluates group-based policies using tokens that only contain group names rather than full paths. If two groups in different parts of the organization share the same name, a user in the unauthorized group can be mistaken for a member of the authorized group. This can allow a user to gain unauthorized access to protected resources they should not be able to reach.","status":"published","published":"2026-08-18T11:08:20.247Z","modified":"2026-11-06T17:34:15.511Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-285"],"updated_at":"2026-11-06T18:59:08.498645Z"}],"euvd":[{"id":"EUVD-2026-60581","description":"A flaw was found in the group policy provider of Keycloak authorization services, which is used to manage fine-grained access control to resources. The issue occurs when the system evaluates group-based policies using tokens that only contain group names rather than full paths. If two groups in different parts of the organization share the same name, a user in the unauthorized group can be mistaken for a member of the authorized group. This can allow a user to gain unauthorized access to protected resources they should not be able to reach.","status":"published","published":"2026-08-18T11:08:20Z","modified":"2026-11-06T17:34:15Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N","level":"medium"}],"updated_at":"2026-11-06T18:05:39.47551Z"}],"ghsa":[{"id":"GHSA-qxf7-g44v-fgwh","title":"A flaw was found in the group policy provider of Keycloak authorization services, which is used...","description":"A flaw was found in the group policy provider of Keycloak authorization services, which is used to manage fine-grained access control to resources. The issue occurs when the system evaluates group-based policies using tokens that only contain group names rather than full paths. If two groups in different parts of the organization share the same name, a user in the unauthorized group can be mistaken for a member of the authorized group. This can allow a user to gain unauthorized access to protected resources they should not be able to reach.","status":"published","published":"2026-08-18T12:31:20Z","modified":"2026-11-06T18:34:45Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N","level":"medium"}],"cwes":["CWE-285"],"updated_at":"2026-11-06T19:01:25.944997Z"}],"nvd":[{"id":"CVE-2026-19608","description":"A flaw was found in the group policy provider of Keycloak authorization services, which is used to manage fine-grained access control to resources. The issue occurs when the system evaluates group-based policies using tokens that only contain group names rather than full paths. If two groups in different parts of the organization share the same name, a user in the unauthorized group can be mistaken for a member of the authorized group. This can allow a user to gain unauthorized access to protected resources they should not be able to reach.","status":"published","published":"2026-08-18T11:16:50.403Z","modified":"2026-11-06T18:18:10.517Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-285"],"updated_at":"2026-11-06T20:01:13.158084Z"}]}}