CVE-2025-14082: Keycloak-services: keycloak admin rest api: improper access control leads to sensitive role metadata information disclosure
A flaw was found in Keycloak Admin REST (Representational State Transfer) API. This vulnerability allows information disclosure of sensitive role metadata via insufficient authorization checks on the /admin/realms/{realm}/roles endpoint.
Other sources
Improper Access Control vulnerability in the Keycloak Admin REST API. A user possessing only the built-in rolequery-groups permission can retrieve the complete list of realm roles, including sensitive administrator-created roles and internal metadata. Although the user cannot access full role details or modify configurations, this unintended exposure of role names, IDs, composite status, and container identifiers stems from insufficient authorization checks on the /admin/realms/{realm}/roles endpoint. A remote authenticated attacker with high-privileged (but restricted) access can leverage this information disclosure to map privilege structures and plan targeted privilege-escalation attempts, affecting the confidentiality of Keycloak deployments.
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-14082?
CVE-2025-14082 has been classified as a medium severity vulnerability due to its potential for information disclosure.
How do I fix CVE-2025-14082?
To fix CVE-2025-14082, ensure that proper authorization checks are implemented on the /admin/realms/{realm}/roles endpoint.
What systems are affected by CVE-2025-14082?
CVE-2025-14082 affects Red Hat Keycloak installations that utilize the Admin REST API.
What type of vulnerability is CVE-2025-14082?
CVE-2025-14082 is an information disclosure vulnerability resulting from insufficient authorization checks.
Can CVE-2025-14082 lead to unauthorized access?
Yes, CVE-2025-14082 can potentially lead to unauthorized access to sensitive role metadata.