Keycloak EUVD-2026-45224

Exploitation requires the attacker to hold an authenticated session with delegated administrator privileges within the target Keycloak realm, corresponding to the CVSS PR:H metric - unauthenticated or standard user accounts cannot trigger this flaw. The vulnerability is specific to the composite role child-role removal operation in the admin REST API; only administrators who have been delegated management rights over at least some roles and who have API access to the composite role endpoint are positioned to exploit it. What limits exploitation: the attacker must first obtain valid delegated admin credentials (through phishing, credential stuffing, or insider threat); the impact is confined to role integrity with no confidentiality exposure; and if Keycloak admin event auditing is enabled, the unauthorized removal will appear in audit logs. The flaw does not require any special non-default configuration to be present - any Keycloak deployment using delegated administration with composite roles is potentially affected.

The CVSS 3.1 score of 4.9 (Medium) is driven primarily by the high privilege requirement (PR:H), which gates exploitation to actors who already hold delegated administrator credentials - a significant real-world barrier. The network attack vector (AV:N) and low complexity (AC:L) confirm that once credentials are obtained, exploitation requires no special technical skill beyond a standard API call. No EPSS score is present in the provided data, and the vulnerability is not listed in the CISA KEV catalog, indicating no confirmed active exploitation at time of analysis. The 'Information Disclosure' tag in the source data is inconsistent with the CVE description, which describes an integrity-only impact; this tag may reflect a tagging artifact or minor information leakage about role structure not described in the advisory - it should not be treated as a confirmed confidentiality impact. The CVSS vector records A:N (no availability impact), yet the description explicitly states users and administrators suffer loss of access - this functional availability consequence is not captured in the base score and may cause defenders to underestimate operational disruption. Real priority is moderate: high in environments with multiple delegated admins and complex composite role structures, lower in small deployments with tightly controlled admin accounts.

An attacker who has compromised or is operating as a malicious delegated administrator within a Keycloak realm identifies a composite role used by higher-privileged administrators or service accounts. Without needing to hold management rights over the privileged child role, the attacker issues a DELETE request to the admin REST API endpoint for composite role membership, successfully removing the privileged child role. All users and administrators assigned the composite role immediately lose the permissions that child role conferred, potentially locking realm administrators out of management functions or disrupting service accounts in downstream applications.