A Missing Authorization flaw was found in the org.keycloak.services.resources.admin package of Keycloak. The Admin REST API endpoint for updating user information (PUT /admin/realms/{realm}/users/{id}) enforces generic user management permissions (requireManage) but fails to validate fine-grained reset-password authorization (requireResetPassword).
In environments where Fine-Grained Admin Permissions (FGAP) are enabled, a delegated administrator who has been granted manage permissions but is explicitly denied reset-password authority can include a credentials object in the user update payload. Because the specific permission check is missing in this code path, the password update is processed successfully.
Successful exploitation allows a restricted administrator to:
Set a new password for any managed user.

Gain full unauthorized access to victim accounts (account takeover).

Lock legitimate users out of their accounts.