CVEvulnerability

CVE-2026-3121

7.2 HIGH Published 2026-03-26 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2026-03-26
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
6.5 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N
CVSS 3.1 ([email protected])
7.2 HIGH — CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-266

Description

A flaw was found in Keycloak. An administrator with `manage-clients` permission can exploit a misconfiguration where this permission is equivalent to `manage-permissions`. This allows the administrator to escalate privileges and gain control over roles, users, or other administrative functions within the realm. This privilege escalation can occur when admin permissions are enabled at the realm level.

Affected configurations

• redhat build of keycloak • redhat jboss enterprise application platform 8.0.0 • redhat jboss enterprise application platform expansion pack • redhat single sign-on 7.0

Related

Weakness · CWE (1)

  • CWE-266 Incorrect Privilege Assignment weakness

References