Keycloak CVE-2025-7784

CRITICAL prerequisite: Fine-Grained Admin Permissions v2 (FGAPv2) must be explicitly enabled in the Keycloak realm configuration. Additionally, the attacker must possess a valid administrative account with at minimum the manage-users role already assigned. Without both conditions, the escalation path does not exist. Standard Keycloak deployments without FGAPv2 enabled are NOT vulnerable. The vulnerability requires authenticated access (PR:H); unauthenticated remote attackers cannot exploit this. No user interaction is required beyond the attacker's own administrative actions. Exploitation is NOT dependent on non-default configuration beyond FGAPv2 enablement; the flaw exists in the FGAPv2 authorization enforcement logic itself.

CVSS 6.5 (PR:H/AC:L/AV:N/S:U) indicates moderate-to-high severity with high-privilege attacker requirement but low complexity and network accessibility. The attack vector is network-based, meaning exploitation does not require local access or system compromise prior to the privilege escalation attempt. The privilege requirement (PR:H) significantly limits the attack surface to already-authenticated administrators with manage-users role. EPSS data is not provided, limiting probabilistic exploitation assessment. The vulnerability is not listed as actively exploited in CISA KEV, and no public proof-of-concept has been identified. However, the risk is REAL and contextual: any organization deploying Keycloak with FGAPv2 enabled faces direct risk from insider threats (rogue administrators) or external attackers who have compromised lower-privileged admin accounts. The confidence and integrity impact (C:H/I:H) means successful exploitation grants full realm-admin authority, enabling account takeovers, policy manipulation, and data exfiltration across all realm-managed applications. This is a privilege-escalation-by-design-flaw rather than a network-reachable zero-day, making it a MUST-PATCH for FGAPv2 users but a lower priority for standard Keycloak deployments without FGAPv2 enabled.

An administrator with manage-users role (permitted to create, modify, and delete user accounts) logs into Keycloak's admin console and, leveraging the improper privilege enforcement in FGAPv2, directly escalates their own role to realm-admin without explicit realm-admin authorization. Once elevated, the attacker gains full administrative authority: modifying realm policies, creating backdoor accounts, changing password reset flows, or integrating malicious identity providers to compromise all applications relying on the Keycloak realm.