Description

A flaw was found in the Admin REST API of Keycloak, an open-source identity and access management solution. The issue occurs in the group-membership endpoints where the system fails to check if a group grants administrative privileges before allowing a user to be added. This allows a delegated administrator with limited permissions to add themselves to a high-privilege group, potentially gaining full control over the entire realm.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.6",
  "pubDate": "2026-09-19T15:17:08.763Z",
  "pubdate": "2026-09-19T15:17:08.763Z",
  "executiveSummary": "A critical privilege escalation vulnerability exists within the Keycloak Admin REST API specifically concerning group-membership management.\nThe flaw originates from an authorization bypass where the application fails to validate whether a target group confers administrative privileges during the user-assignment process.\nAn authenticated user with delegated administrative rights—typically scoped to a limited subset of the realm—can exploit this logic error to assign their own account to a high-privilege group.\nSuccessful exploitation results in full unauthorized administrative control over the entire realm, effectively bypassing intended role-based access control (RBAC) constraints.\nThis vulnerability is particularly severe as it allows for persistent privilege escalation, potentially enabling an attacker to compromise identity provider configurations, manipulate user credentials, and gain complete access to integrated downstream applications.\nExploitation requires existing, albeit limited, administrative access to the Keycloak instance, making it a significant risk for environments utilizing delegated administration models.",
  "technicalDetails": "The vulnerability resides in the Keycloak Admin REST API group-membership endpoint, which handles the association of users with specific identity groups.\nThe root cause is a failure in the authorization logic: the backend service performs insufficient validation checks when a request is made to add a user to a group.\nWhile the system verifies that the authenticated requester has general 'manage-users' or similar delegated privileges within their assigned scope, it fails to perform a secondary access control check to determine if the target group possesses administrative capabilities or elevated scope within the realm.\nIn a secure configuration, administrative groups are intended to be protected such that only super-administrators can modify their membership.\nThe attack flow begins with an attacker possessing legitimate, restricted administrative credentials for a specific subset of the Keycloak realm.\nThe attacker identifies the group identifiers associated with higher-privilege administrative roles or realms.\nBy invoking the Admin REST API endpoint responsible for user-group mapping (typically via a PUT or POST request to the group membership resource), the attacker submits a request to add their own user ID to the targeted high-privilege group.\nBecause the API fails to verify if the requester has the authority to assign users to groups that grant administrative rights, the application processes the request and updates the underlying identity store.\nOnce the membership is updated, the user inherits the roles and permissions associated with the high-privilege group due to Keycloak's role aggregation mechanisms.\nThis transition allows the attacker to move from a delegated administrator (with limited scope) to a realm administrator (with global scope).\nPost-exploitation, the attacker gains full control over the realm, including the ability to modify authentication flows, export user secrets, and manage sensitive integration configurations.\nThe vulnerability is limited to authenticated users; however, the impact is comprehensive, effectively nullifying the security boundaries established by delegated administrative domains."
}