Description

A flaw was found in the Fine-Grained Admin Permissions (FGAP v2) feature of Keycloak, an identity and access management solution. The issue occurs when the system checks if a delegated administrator has permission to assign a specific role to a user. Because the check does not look inside composite roles to see what other permissions they contain, an administrator with limited rights can assign a role that secretly includes full administrative control. This allows the attacker to gain complete management access over the entire realm.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.6",
  "pubDate": "2026-09-25T08:16:42.437Z",
  "pubdate": "2026-09-25T08:16:42.437Z",
  "executiveSummary": "A critical authorization bypass vulnerability exists within the Fine-Grained Admin Permissions (FGAP v2) feature of Keycloak.\nThe vulnerability allows an authenticated delegated administrator to escalate privileges by assigning composite roles that encapsulate administrative capabilities exceeding their intended scope.\nThe core issue stems from an incomplete permission validation mechanism that fails to inspect the hierarchical structure of composite roles during the assignment process.\nBy leveraging this flaw, an attacker with restricted management rights can acquire full administrative control over an entire realm.\nThe risk is severe as it enables unauthorized access to identity data, configuration settings, and user management functions, effectively bypassing the security boundaries defined by the FGAP feature.\nExploitation requires the attacker to already possess limited administrative permissions within the target Keycloak realm, after which they can manipulate role assignments to grant themselves elevated authority.",
  "technicalDetails": "The vulnerability resides within the authorization logic of the Keycloak Fine-Grained Admin Permissions (FGAP v2) module, specifically during the validation routine that governs role assignment operations.\nKeycloak utilizes a composite role structure, which allows a single role to contain one or more constituent roles (nested roles).\nThe root cause of this vulnerability is an 'insecure authorization check' wherein the system validates the assignment of a role based solely on the top-level identity of the role object, without recursing or inspecting the constituent members of the composite role.\nWhen a delegated administrator attempts to assign a role to a user or another administrator, the FGAP check verifies if the delegator has permission to assign that specific top-level role.\nIf the role is a composite role, the authorization check neglects to verify if the delegated administrator has the required authority to grant the specific inner roles contained within that composite object.\nAn attacker can exploit this by identifying a composite role that contains 'realm-admin' or other high-privileged roles, even if the attacker does not possess the explicit permission to grant those high-level roles individually.\nThe attack flow proceeds as follows: 1) The attacker authenticates to Keycloak as a delegated administrator with limited rights; 2) The attacker identifies a target user or entity for privilege escalation; 3) The attacker initiates an API call to assign a composite role to the target; 4) The FGAP v2 validation layer performs a shallow check, erroneously approving the assignment because it lacks visibility into the internal composition of the role; 5) The target user or the attacker (if the role is assigned to self) inherits all permissions granted by the hidden constituent roles.\nThe successful exploitation of this vulnerability results in horizontal and vertical privilege escalation, granting the attacker complete management access to the realm. This includes the ability to modify security policies, manage users, and potentially gain access to sensitive identity provider configurations or client secrets within the affected realm."
}