Listen to this Post
How the CVE Works
The vulnerability occurs when Fine-Grained Admin Permissions (FGAPv2) are enabled in Keycloak. An attacker with the `manage-users` role can exploit improper privilege checks to escalate their permissions to realm-admin. This happens due to insufficient validation when assigning or modifying roles, allowing unauthorized access to sensitive administrative functions. The flaw stems from a missing enforcement mechanism in the role-mapping logic, enabling attackers to bypass intended restrictions and gain elevated privileges.
DailyCVE Form
Platform: Keycloak
Version: FGAPv2-enabled
Vulnerability: Privilege Escalation
Severity: Moderate
Date: Jul 21, 2025
Prediction: Patch by Aug 15, 2025
What Undercode Say
Check if FGAPv2 is enabled keycloak-config.sh --check-permissions Verify user roles kcadm.sh get-roles --target-user <attacker>
// Exploitable code snippet (simplified)
if (user.hasRole("manage-users")) {
grantRealmAdmin(); // Missing privilege check
}
How Exploit
1. Attacker logs in with `manage-users` role.
2. Modifies own role assignments via API.
3. Gains `realm-admin` access.
Protection from this CVE
- Disable FGAPv2 if unused.
- Apply patch when released.
- Audit role assignments regularly.
Impact
- Unauthorized admin access.
- Realm configuration compromise.
- Data exposure risk.
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
