Executive brief
Keycloak is an open-source identity and access management solution used to secure modern applications and services. A security flaw allows a user with limited administrative access to bypass security restrictions and grant themselves full administrative control over the entire system. This could lead to unauthorized access to user data, modification of security policies, and complete takeover of the identity management environment.
Technical details
An improper access control vulnerability (CWE-863) exists in the Keycloak Admin API, specifically the POST /admin/realms/{realm}/partialImport endpoint. The root cause is an insufficient authorization check; the endpoint only verifies the 'requireManageRealm()' permission but fails to enforce per-resource-type permissions required by Fine-Grained Admin Permissions (FGAP). An attacker with limited administrative privileges (specifically the 'manage-realm' role) can exploit this by importing a JSON payload containing users with 'realm-admin' role mappings. This allows the attacker to escalate their privileges to a full realm administrator. The vulnerability has been verified on Keycloak version 26.6.1.
Affected products
- Keycloak Keycloak Verified on 26.6.1
Timeline
- 2026-04-21: other: Reported to Red Hat Bugzilla
- 2026-06-08: advisory: NVD publication date