CVE-2026-18571

CVE-2026-18571 affects Keycloak’s user creation flow when Fine-Grained Admin Permissions V2 (FGAP V2) is enabled. The flaw lets a sub-administrator with permission to create users add those users to any group, including groups the administrator isn’t authorized to manage, potentially enabling una...

EUVD-2026-51925

A flaw was found in the user creation component of Keycloak when Fine-Grained Admin Permissions V2 FGAP V2 is enabled. This issue allows a sub-administrator with permission to create users to add those users to any group, even groups the sub-administrator is not authorized to manage. This could...

CVE-2026-18571 Keycloak-services: keycloak-services: fgap v2 group assignment bypass during user creation

A flaw was found in the user creation component of Keycloak when Fine-Grained Admin Permissions V2 FGAP V2 is enabled. This issue allows a sub-administrator with permission to create users to add those users to any group, even groups the sub-administrator is not authorized to manage. This could...

CVE-2026-18571 Keycloak-services: keycloak-services: fgap v2 group assignment bypass during user creation

A flaw was found in the user creation component of Keycloak when Fine-Grained Admin Permissions V2 FGAP V2 is enabled. This issue allows a sub-administrator with permission to create users to add those users to any group, even groups the sub-administrator is not authorized to manage. This could...

CVE-2026-18571

A flaw was found in the user creation component of Keycloak when Fine-Grained Admin Permissions V2 FGAP V2 is enabled. This issue allows a sub-administrator with permission to create users to add those users to any group, even groups the sub-administrator is not authorized to manage. This could...

CVE-2026-18571

A flaw was found in the user creation component of Keycloak when Fine-Grained Admin Permissions V2 FGAP V2 is enabled. This issue allows a sub-administrator with permission to create users to add those users to any group, even groups the sub-administrator is not authorized to manage. This could...

WordPress Podlove Podcast Publisher plugin < 4.5.3 - Podcast Contributor/Group/Role Creation and Deletion vulnerability

Podcast Contributor/Group/Role Creation and Deletion vulnerability discovered by Ryan Fabella in WordPress Plugin Podlove Podcast Publisher versions 4.5.3...

CVE-2025-69948

SourceCodester Modern Loan Management System 1.0 is vulnerable to SQL Injection in /admin/deletegroup.php?id=1...

CVE-2026-18203

A flaw was found in the group policy evaluation logic of Keycloak, an identity and access management solution. When a group policy is set to extend permissions to child groups, the system incorrectly uses a simple text-based prefix check to verify group membership. This allows a user who belongs ...

CVE-2026-18203 Keycloak-services: keycloak-services: group policy extendchildren matches sibling group path prefixes

A flaw was found in the group policy evaluation logic of Keycloak, an identity and access management solution. When a group policy is set to extend permissions to child groups, the system incorrectly uses a simple text-based prefix check to verify group membership. This allows a user who belongs ...

CVE-2026-18203 Keycloak-services: keycloak-services: group policy extendchildren matches sibling group path prefixes

A flaw was found in the group policy evaluation logic of Keycloak, an identity and access management solution. When a group policy is set to extend permissions to child groups, the system incorrectly uses a simple text-based prefix check to verify group membership. This allows a user who belongs ...

EUVD-2026-51484

A flaw was found in the group policy evaluation logic of Keycloak, an identity and access management solution. When a group policy is set to extend permissions to child groups, the system incorrectly uses a simple text-based prefix check to verify group membership. This allows a user who belongs ...

CVE-2026-18203

CVE-2026-18203 describes a flaw in Keycloak’s group policy evaluation logic: when a group policy is configured to extend permissions to child groups, the system uses a simple text-based prefix check to verify membership. This allows a user from a different group with a similar starting name to by...

CVE-2026-18203

A flaw was found in the group policy evaluation logic of Keycloak, an identity and access management solution. When a group policy is set to extend permissions to child groups, the system incorrectly uses a simple text-based prefix check to verify group membership. This allows a user who belongs ...

CVE-2026-18203

A flaw was found in the group policy evaluation logic of Keycloak, an identity and access management solution. When a group policy is set to extend permissions to child groups, the system incorrectly uses a simple text-based prefix check to verify group membership. This allows a user who belongs ...

CVE-2025-69948

SourceCodester Modern Loan Management System 1.0 is vulnerable to SQL Injection in /admin/deletegroup.php?id=1...

PT-2026-66860

Name of the Vulnerable Software and Affected Versions Modern Loan Management System version 1.0 Description An issue exists that allows SQL Injection, a technique where malicious SQL statements are inserted into entry fields for execution, at the '/admin/delete group.php' endpoint via the id...

EUVD-2025-210575

SourceCodester Modern Loan Management System 1.0 is vulnerable to SQL Injection in /admin/deletegroup.php?id=1...

PT-2026-66722

Name of the Vulnerable Software and Affected Versions Keycloak affected versions not specified Description A flaw exists in the group policy evaluation logic of Keycloak. When a group policy is configured to extend permissions to child groups, the system employs a simple text-based prefix check t...

CVE-2025-69948

SourceCodester Modern Loan Management System 1.0 is vulnerable to SQL Injection in /admin/delete_group.php?id=1. Root cause: unsafely concatenated SQL in the delete_group endpoint (no explicit details beyond description). Impact is high (confidentiality, integrity, and availability potentially af...