Users with low privileges (just plain users in the realm) are able to utilize administrative functionalities within Keycloak admin interface. This issue presents a significant security risk as it allows unauthorized users to perform actions reserved for administrators, potentially leading to data breaches or system compromise.
Acknowledgements:
Special thanks to Maurizio Agazzini for reporting this issue and helping us improve our project.
Vendor | Product | Version | CPE |
---|---|---|---|
org.keycloak | keycloak-services | * | cpe:2.3:a:org.keycloak:keycloak-services:*:*:*:*:*:*:*:* |