Executive brief
A security flaw in Keycloak, a popular identity and access management solution, allows certain administrators to bypass security restrictions. A delegated administrator with permission to manage organizations can create unauthorized user accounts and add them to an organization without having the necessary user management permissions. This could lead to unauthorized access and the creation of rogue accounts within a corporate environment.
Technical details
A permission bypass vulnerability exists in the Keycloak organization REST API's handling of pending invitations. A delegated administrator with 'manage-organizations' permissions but lacking 'manage-users' permissions can create an invitation for an arbitrary email address. The API response for listing pending invitations improperly includes the 'inviteLink' containing a bearer token. An attacker can retrieve this link via the API and use it to register new managed members directly, bypassing both the 'manage-users' permission requirement and the email ownership verification step. This allows for the creation of unauthorized managed user accounts associated with an organization.
Affected products
- Red Hat Red Hat Build of Keycloak unspecified
Timeline
- 2026-07-17: disclosed: CVE published and Red Hat advisory released