What is the CVSS score of CVE-2025-7784?

CVE-2025-7784 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2025-7784?

Yes, a patch is available for CVE-2025-7784. Update the affected software to the latest version immediately.

Keycloak CVE-2025-7784

MEDIUM

Improper Privilege Management (CWE-269)

2025-07-18 secalert@redhat.com

Privilege Escalation Red Hat Build Of Keycloak

6.5

CVSS 3.1

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

May 06, 2026 - 17:30 vuln.today

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

36 maven packages depend on org.keycloak:keycloak-services (16 direct, 20 indirect)

Ecosystem-wide dependent count for version 26.2.0.

DescriptionNVD

A flaw was found in the Keycloak identity and access management system when Fine-Grained Admin Permissions(FGAPv2) are enabled. An administrative user with the manage-users role can escalate their privileges to realm-admin due to improper privilege enforcement. This vulnerability allows unauthorized elevation of access rights, compromising the intended separation of administrative duties and posing a security risk to the realm.

AnalysisAI

Privilege escalation in Keycloak's Fine-Grained Admin Permissions v2 (FGAPv2) allows administrative users with the manage-users role to escalate privileges to realm-admin through improper privilege enforcement. When FGAPv2 is enabled, this vulnerability enables unauthorized elevation of administrative access rights, compromising the separation of administrative duties. No public exploit code or active exploitation has been identified at the time of analysis.

Technical ContextAI

Keycloak is an open-source identity and access management (IAM) system providing authentication, authorization, and user management capabilities. Fine-Grained Admin Permissions v2 (FGAPv2) is an advanced authorization feature designed to enforce granular role-based access control (RBAC) for administrative operations. The vulnerability stems from CWE-269 (Improper Access Control) in the authorization enforcement logic of FGAPv2. Specifically, the manage-users administrative role does not properly validate permission boundaries when escalating to realm-admin privileges, allowing cross-role privilege elevation. This affects Red Hat's build of Keycloak (CPE: cpe:2.3:a:redhat:build_of_keycloak:-:*:*:*:-:*:*:*), indicating the issue exists in the distribution maintained by Red Hat.

RemediationAI

Apply security updates from Red Hat via RHSA-2025:12015 or RHSA-2025:12016 (https://access.redhat.com/errata/RHSA-2025:12015, https://access.redhat.com/errata/RHSA-2025:12016). The exact patched version number is not provided in available data; consult the Red Hat advisories for the specific version to upgrade to. As an interim compensating control, disable Fine-Grained Admin Permissions v2 (FGAPv2) if not operationally required-this eliminates the vulnerability entirely while maintaining standard Keycloak RBAC. If FGAPv2 must remain enabled, restrict the assignment of manage-users role only to fully trusted administrators and enforce strong authentication (MFA) for all administrative accounts. Monitor administrative privilege escalation attempts by auditing role assignment and realm-admin privilege grants. Note that disabling FGAPv2 may reduce authorization granularity, requiring workflow re-evaluation; patch application is the preferred remediation path.