Description
Red Hat Keycloak before version 2.4.0 did not correctly check permissions when handling service account user deletion requests sent to the rest server. An attacker with service account authentication could use this flaw to bypass normal permissions and delete users in a separate realm.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Red Hat | Keycloak | 2.4.0 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Single Sign On 7 | rh-sso7 +1 | 1-2.jbcs.el6 | RHSA-2017:0873, RHSA-2017:0872 |
| Red Hat Single Sign On 7 | rh-sso7-freemarker | 2.3.23-1.redhat_2.2.jbcs.el6 | RHSA-2017:0873, RHSA-2017:0872 |
| Red Hat Single Sign On 7 | rh-sso7-javapackages-tools +1 | 3.4.1-5.15.3.jbcs.el6 | RHSA-2017:0873, RHSA-2017:0872 |
| Red Hat Single Sign On 7 | rh-sso7-keycloak +1 | 2.5.5-2.Final_redhat_1.1.jbcs.el6 | RHSA-2017:0873, RHSA-2017:0872 |
| Red Hat Single Sign On 7 | rh-sso7-libunix-dbus-java +1 | 0.8.0-2.jbcs.el6 | RHSA-2017:0873, RHSA-2017:0872 |
| Red Hat Single Sign On 7 | rh-sso7-liquibase +1 | 3.4.1-2.redhat_2.1.jbcs.el6 | RHSA-2017:0873, RHSA-2017:0872 |
| Red Hat Single Sign On 7 | rh-sso7-twitter4j +1 | 4.0.4-1.redhat_3.1.jbcs.el6 | RHSA-2017:0873, RHSA-2017:0872 |
| Red Hat Single Sign On 7 | rh-sso7-zxing +2 | 3.2.1-1.redhat_4.1.jbcs.el6 | RHSA-2017:0873, RHSA-2017:0872 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | org.keycloak:keycloak-core | < 2.4.0 | 2.4.0 | GHSA-778x-2mqv-w6xw |
Advisories 2
- RHSA-2017:0873 Red Hat Security Advisory: Red Hat Single Sign-On 7.1 update on RHEL 7 Red Hat Security Advisories (RHSA) · Mar 18, 2026
- RHSA-2017:0872 Red Hat Security Advisory: Red Hat Single Sign-On 7.1 update on RHEL 6 Red Hat Security Advisories (RHSA) · Mar 18, 2026
References
- RHSA-2017:0876 vendor-advisory
- 1038180 vdb-entry
- https://bugzilla.redhat.com/show_bug.cgi?id=1388988
- 97392 vdb-entry
- RHSA-2017:0873 vendor-advisory
- RHSA-2017:0872 vendor-advisory