CVE-2026-116468: Keycloak-services: keycloak-services: delegated admin escalates to realm-admin via group move
A flaw was found in the group-move and organization group reparenting endpoints of the keycloak-services component. This component is responsible for core authentication and authorization services in the Red Hat build of Keycloak. The issue occurs because the system fails to check if a target parent group confers administrative roles when a group is moved. A delegated administrator can exploit this to move a group they control under an administrative group, causing all members to inherit full realm-admin privileges and gain complete control over the realm.
Other sources
A privilege escalation vulnerability was identified in Keycloak due to an incomplete fix for CVE-2026-94000. While the previous fix addressed group-membership endpoints, the group-move reparenting and organization group reparenting endpoints remain vulnerable. The flaw exists because these endpoints lack a check to determine if the target parent group is mapped to administrative roles. Exploitation requires the attacker to have a delegated administrator account with the manage-users role and manage permissions on both the source and target groups. By moving a group containing users they control under a group mapped to an administrative role such as realm-admin, the attacker causes those users to inherit the administrative role mappings. Successful exploitation allows an attacker to gain full administrative control over the realm, enabling them to modify realm configurations, manage all users and roles, access sensitive credentials, and potentially cause a complete denial of service by deleting or resetting realm resources.
— Red Hat