Lucene search
+L

GHSA-7XF9-4JFC-WGM4 Keycloak: manage-clients permission escalates to full realm admin access

🗓️ 26 Mar 2026 21:31:26Reported by GoogleType 
osv
 osv
🔗 osv.dev👁 12 Views

Keycloak flaw: manage-clients can escalate to full realm admin when misconfigured as manage-permissions.

Related
Refs
ReporterTitlePublishedViews
Family
attackerkb
ATTACKERKB
CVE-2026-3121
26 Mar 202619:13
attackerkb
circl
Circl
CVE-2026-3121
26 Mar 202620:12
circl
cnnvd
CNNVD
Keycloak 安全漏洞
26 Mar 202600:00
cnnvd
cve
CVE
CVE-2026-3121
26 Mar 202619:13
cve
cvelist
Cvelist
CVE-2026-3121 Keycloak: org.keycloak/keycloak-services: keycloak: privilege escalation via manage-clients permission
26 Mar 202619:13
cvelist
euvd
EUVD
EUVD-2026-16307
26 Mar 202621:31
euvd
github
Github Security Blog
Keycloak: manage-clients permission escalates to full realm admin access
26 Mar 202621:31
github
jvn
Japan Vulnerability Notes
Multiple Vulnerabilities in Hitachi Ops Center Common Services
5 Aug 202601:11
jvn
nvd
NVD
CVE-2026-3121
26 Mar 202619:17
nvd
osv
OSV
ECHO-73AB-600D-62BE Caught by Cursor Bugbot review on PR #19827: the real vulnerability (GHSA-7xf9-4jfc-wgm4) is specific to Fine-Grained Admin Permissions V2's RealmPermissionsV2 treating manage-clients as equivalent to managing the special "admin-permissions" client, which then grants realm-wide admin power. RealmPermissionsV2 and the admin-permissions client concept do not exist in 25.0.6 — its older RealmPermissions.canManageAuthorizationDefault() has no per-ResourceServer parameter at all (it's a single, undifferentiated realm-wide check), so there is no "is this the special admin-permissions client" distinction for a narrow, upstream-faithful fix to attach to. An earlier patch here unconditionally removed MANAGE_CLIENTS from that check to close the described escalation, but that changes intended authorization behavior for every regular client's authorization management, not just a vulnerable path (upstream's real fix leaves the MANAGE_CLIENTS grant intact for non-admin-permissions clients) — reverted.
30 Aug 202616:45
osv
Rows per page

Data

Build on a solid foundation with Vulners data

We provide the essential building blocks for cybersecurity solutions with comprehensive, structured, and constantly updated vulnerability and exploits data

Api

Power your application with Vulners API

The Vulners REST API offers reliable, high-performance access to vulnerability intelligence, with 99.9% SLA uptime and CDN-backed data delivery for seamless global access

App

Assess and manage vulnerabilities with Vulners tools

Built on top of Vulners' database and SDK, end-user solutions give security professionals and developers lightweight and powerful tools for vulnerability remediation

06 Apr 2026 16:48Current
5.8Medium risk
Vulners AI Score5.8
CVSS 3.16.5
EPSS0.00471
12