← CVE Intelligence

CVE-2026-9795

Keycloak: keycloak: privilege escalation via improper scope mapping enforcement PUBLISHED

Description (CNA)

A flaw was found in Keycloak's Fine-Grained Admin Permissions (FGAPv2) feature. An administrator with limited client management permissions can exploit this vulnerability to assign any realm role, including highly privileged roles, to a client's scope mapping. This bypasses intended security controls, allowing the injected role to be projected into a user's authentication token when they access the modified client. This could lead to unauthorized privilege escalation within the Keycloak realm.

Affected (CNA)

Vendor / productVersions
Red Hat / Red Hat build of Keycloak 26.4unaffected 26.4.13-1 before *
Red Hat / Red Hat build of Keycloak 26.4unaffected 26.4-19 before *
Red Hat / Red Hat build of Keycloak 26.4unaffected 26.4-19 before *
Red Hat / Red Hat build of Keycloak 26.4.13unaffected
Red Hat / Red Hat build of Keycloak 26.6unaffected 26.6.4-2 before *
Red Hat / Red Hat build of Keycloak 26.6unaffected 26.6-8 before *
Red Hat / Red Hat build of Keycloak 26.6unaffected 26.6-8 before *
Red Hat / Red Hat build of Keycloak 26.6.4unaffected

CWE

CWE-266

References

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.

redhat-SADP

A flaw was found in Keycloak's Fine-Grained Admin Permissions (FGAPv2) feature. An administrator with limited client management permissions can exploit this vulnerability to assign any realm role, including highly privileged roles, to a client's scope mapping. This bypasses intended security controls, allowing the injected role to be projected into a user's authentication token when they access the modified client. This could lead to unauthorized privilege escalation within the Keycloak realm.