Keycloak EUVD-2026-80854

Exploitation requires an authenticated Keycloak account that has already been granted the realm 'impersonation' role (a delegated admin capability, hence CVSS PR:H). Given that role, the attacker impersonates a realm administrator and obtains full administrative control of the realm (users, clients, roles). Limiting factors: this is not a pre-authentication or default-config remote takeover - it depends on the attacker/insider possessing the impersonation role beforehand, so realistic risk centers on trusted sub-administrators, over-privileged support accounts, or an already-compromised delegated-admin credential. Affected: Red Hat Build of Keycloak 26.4 (before 26.4.16) and 26.6 (before 26.6.7).

This is a genuine but access-gated privilege-escalation issue (CWE-862, missing authorization). The Red Hat CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H = 7.2 High) is internally consistent with the description: the attacker must already hold the delegated 'impersonation' role (PR:H), so this is not a pre-auth internet-wide exploit but an escalation from an existing privileged sub-administrator to full realm administrator. There is no EPSS score, no CISA KEV listing, and no public PoC in the provided data, so exploitation status is 'no public exploit identified at time of analysis.' The signals are aligned rather than conflicting - a High CVSS driven by full C/I/A realm-admin impact, tempered by the PR:H barrier that limits the exploit population to accounts already granted impersonation rights. Real-world priority is moderate: high impact but requires a trusted-insider or already-compromised delegated-admin account. One caveat worth verifying with Red Hat: whether the required role should be scored PR:H (full delegated admin) or PR:L (a narrowly-granted impersonation permission) - that choice moves the base score and the realistic exploit population.

A tenant/sub-administrator in a Keycloak realm who has been granted only the 'impersonation' role (intended to let them act as ordinary users for support) abuses the flawed authorization check to impersonate a realm administrator instead. Having assumed the admin identity, they manage users, clients, and roles across the entire realm - full administrative takeover. No public PoC is available in the provided data; exploitation requires an authenticated account that already holds the impersonation role.