EUVD-2026-39472
GHSA-rmcj-82cr-27rx
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate as limited delegated group admin
-
DeliveryIdentify privileged target group (realm-admin)
-
ExploitCall Admin REST API addChild() to reparent it
-
ExecutionInherit management and password-reset over its members
-
PersistReset administrator password
-
ImpactTake over account and full realm
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Object-level authorization, IDOR prevention
|
| Exploitation Conditions | Exploitation requires (1) Keycloak configured with Fine-Grained Admin Permissions v2 (FGAPv2) enabled, (2) an authenticated account that already holds management (manage) rights over at least one group (a limited delegated administrator), and (3) the existence of a more privileged target group such as one possessing the realm-admin role; the attacker then invokes the Admin REST API GroupResource.addChild() endpoint to reparent that privileged group under their managed group. Limiting factors that reduce real-world risk: it is NOT remote-unauthenticated (CVSS PR:H - prior delegated-admin privileges are mandatory), it does NOT apply to default deployments without FGAPv2, CVSS marks AC:H indicating non-trivial conditions, and no user interaction is required (UI:N). |
| Impact | Signals point to a high-impact-but-constrained issue. The CVSS 3.1 vector (AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:N, base 7.7 High) reflects network reachability and scope-changing impact, but explicitly encodes meaningful barriers: AC:H (high attack complexity) and PR:H (the attacker must already hold delegated admin/group-management rights), and the flaw only applies where FGAPv2 is enabled. No EPSS score was supplied and the CVE is not in CISA KEV, so there is no evidence of active exploitation; no public PoC was provided, so this is not a mass-exploitation candidate today. The honest read: a real and severe insider/lateral-escalation risk in multi-tenant or delegated-administration Keycloak deployments using FGAPv2, but not an unauthenticated internet-wide threat. EPSS and SSVC automatable/exploitation data were not present in the input, so widespread-exploitation likelihood cannot be quantified from available signals. |
| Exploit ScenarioDerived | In a Keycloak realm using FGAPv2, an attacker holds a delegated-admin account with manage rights over only one low-privilege group (for example a tenant or team group). Using the Admin REST API addChild() call they reparent the realm-admin-bearing group under their managed group, inheriting management and password-reset authority over its members, then reset an administrator's password and take over the realm. No public PoC was provided, but the steps require only existing delegated-admin API access. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jun 25, 2026
Privilege escalation in Keycloak (Red Hat Build of Keycloak) lets an authenticated delegated admin with management rights over a single low-privilege group hijack the entire realm. A missing authorization check in the Admin REST API's GroupResource.addChild() endpoint allows reparenting an arbitrary group; when Fine-Grained Admin Permissions v2 (FGAPv2) is enabled, an attacker can move a privileged group (e.g., one holding realm-admin) under a group they control, inheriting management and password-reset rights over its members. There is no public exploit identified at time of analysis and the issue is not in CISA KEV, but the resulting full realm takeover makes it a serious escalation primitive in environments that delegate group administration.
RemediationAI
No vendor-released patch version was identified at time of analysis from the provided data; consult the Red Hat advisory (https://access.redhat.com/security/cve/CVE-2026-9099) and Bugzilla 2480182 (https://bugzilla.redhat.com/show_bug.cgi?id=2480182) for the fixed build and apply it as the primary remediation once published. As a targeted compensating control until patched, disable Fine-Grained Admin Permissions v2 (FGAPv2) where it is not strictly required, since the escalation path only exists when FGAPv2 is enabled (trade-off: loss of granular delegated administration, possibly forcing a fallback to coarser admin roles). Where FGAPv2 must stay enabled, minimize the number of accounts granted group-management (manage) rights, avoid placing highly privileged groups such as those holding realm-admin where delegated admins can target them, and audit the admin event log for unexpected group reparent (addChild) operations. Restricting and monitoring Admin REST API access and reviewing delegated group permissions reduces exposure but does not fully close the flaw without the vendor fix.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Keycloak is a widely used open-source identity and access management server (the upstream of Red Hat Build of Keycloak / RHSSO) providing OIDC and SAML SSO, federation, and fine-grained admin delegation. The flaw lives in the Admin REST API GroupResource.addChild() operation, which reparents groups within Keycloak's hierarchical group tree. Keycloak's Fine-Grained Admin Permissions v2 (FGAPv2) model derives a delegated admin's authority partly from group hierarchy, so management permissions granted on a parent group cascade to its child groups and their members. The root cause is CWE-639 (Authorization Bypass Through User-Controlled Key / IDOR-style missing object-level check): addChild() validates the caller's rights over the destination relationship but fails to verify the caller is authorized over the group actually being moved, letting a low-privileged group manager graft a high-privileged group beneath their own.
Know when Red Hat Build Of Keycloak gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:N
Network-reachable Admin REST API (AV:N) but needs existing delegated group-admin rights and FGAPv2 (PR:H, AC:H); cross-authority realm takeover yields S:C with full C/I/A impact.
Primary rating from Vendor (redhat).
CVSS VectorVendor: redhat
DescriptionCVE.org
A flaw was found in Keycloak. A missing authorization check in the GroupResource.addChild() endpoint within the Admin REST API allows an authenticated user with limited administrative privileges to reparent any existing group. When Fine-Grained Admin Permissions v2 (FGAPv2) is enabled, an attacker with management rights over a single low-privilege group can reparent a highly privileged group (such as one possessing the realm-admin role) under their managed group.
Because group permissions follow a hierarchical structure, this action unauthorizedly grants the attacker management and password-reset capabilities over the members of the targeted privileged group. An attacker can exploit this to reset an administrator's password, compromise the account, and achieve a full realm takeover, leading to a complete compromise of confidentiality, integrity, and availability.
Executive ViewAI
A privilege escalation vulnerability in Red Hat Build of Keycloak allows authenticated administrators with delegated group management rights to circumvent authorization controls and assume control of the entire identity realm. Organizations using delegated administration for group management face potential compromise of all user accounts and authentication services when Fine-Grained Admin Permissions v2 is enabled. Successful exploitation results in complete identity infrastructure takeover affecting all downstream applications and user trust.
No vendor-released patch identified at time of analysis. Interim mitigations: (1) Disable Fine-Grained Admin Permissions v2 where operationally feasible; (2) Revoke delegated group administration rights or limit scope to non-sensitive groups only; (3) Implement audit logging for all GroupResource API calls, particularly addChild() operations; (4) Enforce multi-factor authentication for all delegated administrative accounts; (5) Restrict Admin REST API network access to privileged administrative networks; (6) Deploy real-time alerts on group reparenting events targeting high-privilege groups (realm-admin, etc.).
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
More in Red Hat Build Of Keycloak
View allAccount takeover in Red Hat Build of Keycloak allows an unauthenticated attacker to abuse the reset-credentials flow in
Account takeover in Keycloak (Red Hat build of Keycloak, Red Hat Single Sign-On 7) arises because the IdP-initiated SAML
Authentication bypass in Red Hat Build of Keycloak (and Red Hat Single Sign-On 7) lets an unauthenticated attacker forge
Privilege escalation in Red Hat Build of Keycloak's Dynamic Client Registration (DCR) grants an attacker with low-privil
Mismatched handling of the HTTP/1 absolute-form request authority in Red Hat build of Quarkus and other affected Red Hat
Authorization bypass in the Keycloak Policy Enforcer allows any authenticated user to circumvent all enforced access con
URI normalization bypass in Keycloak's Authorization Services PathMatcher allows authenticated low-privilege users to re
Privilege escalation in Keycloak's Dynamic Client Registration (DCR) component allows attackers with standard user accou
Token exchange in Keycloak bypasses Google Workspace domain allowlist restrictions, enabling any valid Google account ho
Signature-verification bypass in Keycloak (and Red Hat's Keycloak-based products such as Red Hat Single Sign-On 7 and Re
Tenant-restriction bypass in Keycloak's Microsoft identity provider integration allows attackers holding any valid Micro
Session hijacking via SAML assertion replay in Keycloak's SAML broker component allows adjacent-network attackers to aut
Exploit-DB