CVE-2026-9795: Keycloak: keycloak: privilege escalation via improper scope mapping enforcement
Description A flaw was found in Keycloak's Fine-Grained Admin Permissions (FGAPv2) feature. An administrator with limited client management permissions can exploit this vulnerability to assign any realm role, including highly privileged roles, to a client's scope mapping. This bypasses intended security controls, allowing the injected role to be projected into a user's authentication token when they access the modified client. This could lead to unauthorized privilege escalation within the Keycloak realm.
Other sources
Summary
Under FGAPv2, the ScopeMappedResource and ScopeMappedClientResource write endpoints (add and delete scope mappings) do not call requireMapClientScope per role. An admin holding only fine-grained manage on a single client can attach any realm role — including realm-admin — to that client's scope mapping, bypassing the MAPROLECLIENTSCOPE permission boundary. When a privileged user subsequently authenticates through the modified client, the injected role is projected into the issued token.
Requirements to exploit
FGAPv2 enabled on the realm (adminPermissionsEnabled=true)
Attacker holds fine-grained manage permission on at least one client
A user holding the targeted role (e.g. realm-admin) must authenticate through the modified client
Component affected: org.keycloak.services.resources.admin
Version affected: All versions with FGAPv2 support
Patch available: no
File issue trackers? Yes
CVSS: CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:N (7.3 High)
Embargo: no
Acknowledgement:
Andrej Tomci
Github - @andrejtomci
Steps to reproduce
1. Enable FGAPv2 on the realm (adminPermissionsEnabled=true) 2. Create a delegated admin with fine-grained manage on a single client — no global manage-clients, no MAPROLECLIENTSCOPE on any privileged role 3. As the delegated admin, call POST /admin/realms/{r}/clients/{uuid}/scope-mappings/realm with realm-admin in the roles body — the request succeeds despite no MAPROLECLIENTSCOPE permission 4. Optionally flip fullScopeAllowed=true on the client via PUT /admin/realms/{r}/clients/{uuid} 5. Authenticate as a user holding realm-admin through the modified client 6. Inspect the issued token — realm-admin is projected into the token via the injected scope mapping
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
maven/org.keycloak:keycloak-servicesto a version that resolves this vulnerability.Fixed in 26.6.4
Event History
Frequently Asked Questions
What is the severity of CVE-2026-9795?
The severity of CVE-2026-9795 is classified as high, with a score of 7.3.
How can CVE-2026-9795 be exploited?
CVE-2026-9795 can be exploited by an administrator with limited client management permissions to assign any realm role to a client's scope mapping.
What software is affected by CVE-2026-9795?
CVE-2026-9795 affects Keycloak, particularly its Fine-Grained Admin Permissions (FGAPv2) feature.
How do I fix CVE-2026-9795?
To fix CVE-2026-9795, upgrade to the latest version of Keycloak that addresses this vulnerability.
What are the potential impacts of CVE-2026-9795?
The potential impacts of CVE-2026-9795 include unauthorized privilege escalation and bypassing intended security controls.