CVE-2025-14083: Keycloak-server: keycloak: improper access control in admin rest api leads to information disclosure
A flaw was found in the Keycloak Admin REST API. This vulnerability allows the exposure of backend schema and rules, potentially leading to targeted attacks or privilege escalation via improper access control.
Other sources
An Improper Access Control vulnerability exists in the Keycloak Admin REST API, where a user possessing only the create-client permission—considered low-privilege by design—can unexpectedly access the /admin/realms/master/users/profile endpoint. This endpoint returns internal user profile schema data, including attribute names, validation rules, display metadata, and permission mappings. Although the attacker cannot view actual user accounts, the exposure of backend schema and rules results from insufficient authorization checks specifically on this endpoint. An authenticated but minimally privileged user can remotely retrieve sensitive configuration metadata, which may be leveraged to craft targeted attacks or prepare future privilege-escalation attempts.
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-14083?
CVE-2025-14083 is classified as a medium severity vulnerability due to improper access control in the Keycloak Admin REST API.
How do I fix CVE-2025-14083?
To fix CVE-2025-14083, update to Keycloak version 26.2.6 or higher, which resolves the access control issue.
What can attackers do with CVE-2025-14083?
Attackers can use CVE-2025-14083 to gain unauthorized access to backend schema and rules, potentially leading to information disclosure and privilege escalation.
Which versions of Keycloak are affected by CVE-2025-14083?
CVE-2025-14083 affects Keycloak versions up to and including 26.2.5.
Is CVE-2025-14083 a known issue for Keycloak installations?
Yes, CVE-2025-14083 is a known issue that has been reported and documented in various security advisories.