CVE-2025-7784
Fixed in a distro release EPSS <1%CVSS 6.5
A flaw was found in the Keycloak identity and access management system when Fine-Grained Admin Permissions(FGAPv2) are enabled. An administrative user with the manage-users role can escalate their privileges to realm-admin due to improper privilege enforcement. This vulnerability allows unauthorized elevation of access rights, compromising the intended separation of administrative duties and posing a security risk to the realm.
Products: Red Hat build of Keycloak 26, Red Hat build of Keycloak 26.2, Red Hat JBoss Enterprise Application Platform 8, Red Hat JBoss Enterprise Application Platform Expansion Pack, Red Hat Single Sign-On 7
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| Maven | org.keycloak:keycloak-services | 26.2.6 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Chainguard | keycloak | no fix |
| Chainguard | keycloak-26.2 | 26.2.5-r6 |
| Chainguard | keycloak-26.2 | no fix |
| Chainguard | keycloak-26.2-compat | 26.2.5-r6 |
| Chainguard | keycloak-26.2-iamguarded-compat | no fix |
| Chainguard | keycloak-fips-26.2-iamguarded-fips | no fix |
| Wolfi | keycloak | no fix |