REDHAT-BUG-2539965: Medium severity Red Hat Keycloak vulnerability
A Missing Authorization flaw was found in the org.keycloak.services.resources.admin package of Keycloak. The Admin REST API endpoint for updating user information (PUT /admin/realms/{realm}/users/{id}) enforces generic user management permissions (requireManage) but fails to validate fine-grained reset-password authorization (requireResetPassword). In environments where Fine-Grained Admin Permissions (FGAP) are enabled, a delegated administrator who has been granted manage permissions but is explicitly denied reset-password authority can include a credentials object in the user update payload. Because the specific permission check is missing in this code path, the password update is processed successfully. Successful exploitation allows a restricted administrator to: Set a new password for any managed user.
Gain full unauthorized access to victim accounts (account takeover).
Lock legitimate users out of their accounts.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated delegated administrator in an environment with Fine-Grained Admin Permissions enabled can exploit it if they have generic user-management permission for a user but are explicitly denied reset-password permission.
Does exploitation require access to the Admin REST API?
Yes. The affected operation is the user update endpoint, PUT /admin/realms/{realm}/users/{id}, and the attacker must be able to submit an update payload containing a credentials object.
What is the impact of a successful exploit?
The restricted administrator can set a new password for a managed user, take over that account, and potentially lock the legitimate user out.
How can administrators identify potentially affected activity?
Review use of the user update endpoint for payloads containing a credentials object, particularly actions performed by delegated administrators who have manage permission but lack reset-password authority.