Executive Summary

CVE-2026-3121 is a privilege escalation vulnerability in Keycloak. It occurs because an administrator with the `manage-clients` permission can exploit a misconfiguration where this permission is effectively equivalent to `manage-permissions`. This means that an admin who should only manage clients can actually manage permissions as well.

As a result, such an administrator can escalate their privileges by assigning themselves or others additional permissions, including control over roles, users, or other sensitive administrative functions within the Keycloak realm.

This vulnerability happens when admin permissions are enabled at the realm level in Keycloak, allowing the permission overlap to be exploited.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can allow an attacker who already has `manage-clients` administrator rights to escalate their privileges beyond their intended scope.

• Gain control over roles within the realm.
• Gain control over users and their permissions.
• Manage other sensitive administrative functions.

Such privilege escalation can lead to unauthorized access, modification, or disruption of the Keycloak realm's security and user management.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by reviewing the Keycloak realm configuration and the permissions assigned to administrators. Specifically, check if the 'manage-clients' permission is granted to any administrator in a realm where admin permissions are enabled at the realm level.

To reproduce or detect the vulnerability, verify if an administrator with 'manage-clients' permission can escalate privileges by managing roles, users, or other administrative functions.

While no explicit commands are provided, the detection involves inspecting Keycloak realm settings under Realm Settings -> General to see if admin permissions are enabled, and auditing user permissions for 'manage-clients'.

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation involves disabling admin permissions at the realm level in Keycloak to prevent the 'manage-clients' permission from equating to 'manage-permissions'.

Additionally, review and restrict the assignment of 'manage-clients' permission to administrators, ensuring it is only granted when absolutely necessary and with awareness of the associated privilege escalation risk.

Monitor and audit administrative roles and permissions regularly to detect any unauthorized privilege escalations.

Useful 0 Not Useful 0