CVE-2026-94000: Keycloak-services: keycloak-services: delegated admin with manage-users can escalate to realm-admin via group membership
A flaw was found in the Admin REST API of Keycloak, an open-source identity and access management solution. The issue occurs in the group-membership endpoints where the system fails to check if a group grants administrative privileges before allowing a user to be added. This allows a delegated administrator with limited permissions to add themselves to a high-privilege group, potentially gaining full control over the entire realm.
Other sources
Improper Authorization in the Admin REST API group-membership endpoints (UserResource.joinGroup and the groups list in UsersResource.createUser) allows for privilege escalation. The root cause is a missing check to determine if a group confers administrative roles when a delegated administrator manages group memberships. Exploitation requires the attacker to have a delegated administrator account with the manage-users role and the existence of a pre-configured group that maps to the realm-admin role. A successful attacker can add their own account or a new account to such a group, bypassing direct role assignment restrictions. Concrete impact: The attacker gains full administrative control over the realm, allowing them to modify realm configurations, manage all users and roles, access sensitive credentials, and potentially cause a complete denial of service by deleting realm resources.
— Red Hat
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker needs a delegated administrator account that has the manage-users role. They also need a pre-configured group whose membership maps to the realm-admin role.
Is a default deployment affected?
Exploitation depends on the presence of a group configured to grant realm-admin privileges, in addition to a delegated administrator with manage-users. The provided information does not establish that this group configuration exists by default.
What can an attacker do after successful exploitation?
The attacker can add their own account, or a newly created account, to the privileged group and obtain full administrative control of the realm. This permits modification of realm configurations and bypasses direct role-assignment restrictions.
How can administrators assess whether they are exposed?
Review delegated administrator accounts for the manage-users role, and identify groups that map membership to the realm-admin role. Exposure requires both conditions to be present.