2026-09-06 · run 2026-09-06-cve-2026-16108-default-groups-disclosure

CVE-2026-16108: realm default-group reads no longer disclose hidden groups

Condition: CVE-2026-16108 (FGAP v2: a realm-viewing admin could see names/ids of hidden default groups via default-groups and the realm representation)

Question

Does 26.7.3 enforce the CVE-2026-16108 fix — i.e. does the default-groups endpoint and the realm representation (defaultGroups field) filter hidden groups by the caller's per-group view permission?

Method

Same FGAP-v2 fixture as 2026-09-06-cve-2026-14613-role-groups-disclosure (realm fgap-cves, service-account delegated admin with view-realm, no per-group view on the hidden group). A group hidden-default-group is added as a realm default group (visible to the master admin, hidden from the delegated admin).

Then, as the delegated admin:

GET /admin/realms/fgap-cves/default-groups → must not include the hidden group
GET /admin/realms/fgap-cves → defaultGroups must not include the hidden path
GET /admin/realms/fgap-cves/groups/{hidden-default-group} → expect 403 (control)

Result

Call	Response
`GET .../default-groups`	200 — `[]` (empty; hidden group absent)
`GET .../fgap-cves` (realm rep)	`defaultGroups` = `null` (hidden path absent)
`GET .../groups/{hidden-default-group}`	HTTP 403 (control: the group is genuinely hidden)

Finding

26.7.3 filters both default-group read paths by per-group view — the hidden default group appears in neither the default-groups list nor the realm representation's defaultGroups field. The fix adds .filter(auth.groups()::canView) to RealmAdminResource.getDefaultGroups and getRealm, and the equivalent filtering in RealmsAdminResource.toRealmRep (the /admin/realms listing path).

Primary source: commit 073d2e800da18b586e95c4820a06208c60d5ef18 "Realm default-group reads disclose hidden groups under FGAP v2" (closes #51001).

Verification

Claim	Primary source	Checked
`getDefaultGroups` filters by `groups()::canView`	commit `073d2e80` diff, `RealmAdminResource.java`	☑
`getRealm` filters `defaultGroups` by `groups()::canView`	commit `073d2e80` diff, `RealmAdminResource.java`	☑
Realm listing (`/admin/realms`) filters too	commit `073d2e80` diff, `RealmsAdminResource.toRealmRep`	☑
Hidden default group absent from both live reads	live `default-groups` = `[]`, realm rep `defaultGroups` = `null`	☑
Group is genuinely hidden from the caller	live `GET /groups/{hidden-default-group}` → 403	☑