Description
A flaw was found in the Keycloak identity and access management system when Fine-Grained Admin Permissions(FGAPv2) are enabled. An administrative user with the manage-users role can escalate their privileges to realm-admin due to improper privilege enforcement. This vulnerability allows unauthorized elevation of access rights, compromising the intended separation of administrative duties and posing a security risk to the realm.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | keycloak | < 26.2.6 | 26.2.6 |
| Red Hat | Red Hat build of Keycloak 26 | — | — |
| Red Hat | Red Hat build of Keycloak 26.2 | — | — |
| Red Hat | Red Hat JBoss Enterprise Application Platform 8 | — | — |
| Red Hat | Red Hat JBoss Enterprise Application Platform Expansion Pack | — | — |
| Red Hat | Red Hat Single Sign-On 7 | — | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | org.keycloak:keycloak-services | >= 26.2.0, < 26.2.6 | 26.2.6 | GHSA-27gp-8389-hm4w |
Advisories 2
- WID-SEC-2025-1607 Keycloak: Schwachstelle ermöglicht Privilegieneskalation BSI CERT-Bund (WID) · Jul 28, 2025
- NCSC-2025-0232 Kwetsbaarheid verholpen in Keycloak NCSC-NL (Netherlands) · Jul 18, 2025
References
- RHSA-2025:12015 vendor-advisory
- RHSA-2025:12016 vendor-advisory
- https://access.redhat.com/security/cve/CVE-2025-7784 vdb-entry
- RHBZ#2381861 issue-tracking
- https://github.com/keycloak/keycloak/issues/39956