Bug 2560575 (CVE-2026-116468)

Summary: CVE-2026-116468 keycloak-services: keycloak-services: Delegated admin escalates to realm-admin via group move
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security <prodsec-ir-bot>
Status: NEW --- QA Contact:
Severity: high Docs Contact:
Priority: high    
Version: unspecifiedCC: aschwart, aszczucz, boliveir, drichtar, mposolda, pjindal, rmartinc, security-response-team, ssilvert, sthorger, vmuzikar
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in the group-move and organization group reparenting endpoints of the keycloak-services component. This component is responsible for core authentication and authorization services in the Red Hat build of Keycloak. The issue occurs because the system fails to check if a target parent group confers administrative roles when a group is moved. A delegated administrator can exploit this to move a group they control under an administrative group, causing all members to inherit full realm-admin privileges and gain complete control over the realm.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Deadline: 2026-12-22   

Description OSIDB Bzimport 2026-10-26 10:31:35 UTC 
A privilege escalation vulnerability was identified in Keycloak due to an incomplete fix for CVE-2026-94000. While the previous fix addressed group-membership endpoints, the group-move reparenting and organization group reparenting endpoints remain vulnerable. The flaw exists because these endpoints lack a check to determine if the target parent group is mapped to administrative roles.
Exploitation requires the attacker to have a delegated administrator account with the manage-users role and manage permissions on both the source and target groups. By moving a group containing users they control under a group mapped to an administrative role such as realm-admin, the attacker causes those users to inherit the administrative role mappings.
Successful exploitation allows an attacker to gain full administrative control over the realm, enabling them to modify realm configurations, manage all users and roles, access sensitive credentials, and potentially cause a complete denial of service by deleting or resetting realm resources.