Listen to this Post
The CVE-2025-XXXXX vulnerability in Keycloak allows privilege escalation in the Admin Console when FGAPv2 (Fine-Grained Admin Permissions v2) is enabled. The flaw exists in versions 26.2.0 to 26.2.5 due to improper permission validation in role-mapping operations. An attacker with `manage-users` privileges can exploit a missing boundary check in the Admin REST API to self-assign the `realm-admin` role. This occurs because the role assignment endpoint does not verify if the requesting user has sufficient privileges to modify their own elevated permissions. The exploit involves sending a crafted POST request to /admin/realms/{realm}/users/{id}/role-mappings/realm, allowing a lower-privileged admin to gain full administrative control over the realm.
DailyCVE Form:
Platform: Keycloak
Version: 26.2.0 – 26.2.5
Vulnerability: Privilege Escalation
Severity: Moderate
Date: Jul 30, 2025
Prediction: Patch by Aug 5, 2025
What Undercode Say:
curl -X POST 'http://keycloak/admin/realms/master/users/self/role-mappings/realm' \
-H "Authorization: Bearer <token>" \
-d '[{"id":"realm-admin","name":"admin"}]'
How Exploit:
1. Authenticate as `manage-users` admin.
2. Send role-mapping request.
3. Gain `realm-admin` access.
Protection from this CVE:
- Upgrade to 26.2.6+.
- Disable FGAPv2 if unused.
- Audit admin role assignments.
Impact:
- Full realm compromise.
- Unauthorized data access.
- Configuration manipulation.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
