Keycloak Organization Management Privilege Escalation

Executive Summary

This vulnerability in Keycloak allows a delegated administrator with manage-organizations permission but without manage-users permission to create an invitation for a non-existent email address. The API response includes a secret registration link that can be used to bypass email verification and create unauthorized user accounts directly in the organization.

Useful 0 Not Useful 0

Detection Guidance

Check Keycloak server logs for unusual API calls to the organization management endpoints, particularly requests fetching pending invitations or registration links. Look for repeated attempts to access the inviteLink field in API responses.

Useful 0 Not Useful 0

Impact Analysis

An attacker with delegated admin privileges could exploit this to add unauthorized users to an organization, bypassing security controls. This could lead to unauthorized access, privilege escalation, or unauthorized actions within the organization's Keycloak instance.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could violate compliance requirements by allowing unauthorized user access, potentially leading to data breaches or unauthorized data exposure. Organizations using Keycloak may fail to meet access control and audit requirements under GDPR, HIPAA, or other regulations.

Useful 0 Not Useful 0

Mitigation Strategies

Apply the latest Keycloak security patches immediately. Review all delegated administrators' permissions to ensure they do not have both manage-organizations and manage-users permissions. Monitor organization membership changes for unauthorized additions.

Useful 0 Not Useful 0