CVE-2026-96448: Keycloak-services: keycloak-services: fgap v2 composite-blind role mapping allows privilege escalation
A flaw was found in the Fine-Grained Admin Permissions (FGAP v2) feature of Keycloak, an identity and access management solution. The issue occurs when the system checks if a delegated administrator has permission to assign a specific role to a user. Because the check does not look inside composite roles to see what other permissions they contain, an administrator with limited rights can assign a role that secretly includes full administrative control. This allows the attacker to gain complete management access over the entire realm.
Affected Software
Event History
Frequently Asked Questions
Who is realistically exposed to this issue?
Deployments using Keycloak's Fine-Grained Admin Permissions version 2 are exposed when delegated administrators can assign roles to users. The risk is greatest where composite roles may contain permissions that grant broad or full realm administration.
What access does an attacker need to exploit it?
An attacker needs delegated administrative access with permission to assign a role to a user. Exploitation also requires a composite role whose nested permissions provide greater administrative authority than the attacker is intended to have.
What is the impact of successful exploitation?
A delegated administrator can assign a composite role that contains unexamined administrative permissions and escalate to complete management access for the entire realm.