Privileged Role Removal in Keycloak via Missing Authorization

Executive Summary

This vulnerability is in Keycloak's admin REST API. It allows delegated administrators with limited permissions to remove privileged child roles from composite roles without proper authorization checks. The issue specifically affects DELETE endpoints for role composites, which do not enforce per-child role checks unlike the add operation.

Useful 0 Not Useful 0

Detection Guidance

Check Keycloak server logs for unauthorized DELETE requests to role composite endpoints. Look for requests targeting privileged roles like realm-admin. Verify if delegated administrators are performing role removal operations outside expected workflows.

Useful 0 Not Useful 0

Impact Analysis

An attacker with a delegated admin account could remove high-privilege roles like realm-admin from composite roles. This would strip those roles from assigned users or groups, degrading administrative privileges or disrupting realm functionality. No user interaction is required for exploitation.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could impact compliance with GDPR and HIPAA by enabling unauthorized privilege removal. Attackers with delegated admin access could strip high-privilege roles like realm-admin, leading to unauthorized access or denial of critical functions. This may violate access control requirements in GDPR (Article 32) and HIPAA (45 CFR § 164.308(a)(4)).

Useful 0 Not Useful 0

Mitigation Strategies

Apply the latest Keycloak security patch immediately. Review delegated administrator permissions and restrict manage permissions on parent role containers. Monitor role composite changes and audit privileged role modifications.

Useful 0 Not Useful 0