CVE-2026-96448
Received Received - Intake

Fine-Grained Admin Permissions Privilege Escalation in Keycloak

Publication date: 2026-09-25

Last updated on: 2026-09-25

Assigner: redhat-SADP

Description
A flaw was found in the Fine-Grained Admin Permissions (FGAP v2) feature of Keycloak, an identity and access management solution. The issue occurs when the system checks if a delegated administrator has permission to assign a specific role to a user. Because the check does not look inside composite roles to see what other permissions they contain, an administrator with limited rights can assign a role that secretly includes full administrative control. This allows the attacker to gain complete management access over the entire realm.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-25
Last Modified
2026-09-25
Generated
2026-09-25
AI Q&A
2026-09-25
EPSS Evaluated
N/A
NVD
CVE-2026-96448
EUVD
EUVD-2026-86588

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
redhat keycloak 2

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-285 The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is in Keycloak's Fine-Grained Admin Permissions (FGAP v2) feature. It allows an attacker with limited admin rights to assign a composite role that secretly includes full administrative permissions. The system fails to check inside composite roles for hidden privileges, enabling privilege escalation to full realm control.

Impact Analysis

If exploited, this flaw allows an attacker to gain complete administrative control over the entire Keycloak realm. This means they can manage users, roles, and permissions without proper authorization. The attack requires pre-existing composite roles with privileged permissions and high privileges to assign them.

Compliance Impact

This vulnerability could lead to unauthorized administrative access, potentially violating data protection requirements under GDPR and HIPAA by allowing unauthorized users to manage sensitive user data and permissions.

Mitigation Strategies

No immediate mitigation steps are currently available or sufficient according to the provided resources. The vulnerability stems from a design flaw in Keycloak's Fine-Grained Admin Permissions feature that lacks recursive authorization checks.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-96448. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart