A privilege escalation vulnerability was identified in Keycloak due to an incomplete fix for CVE-2026-94000. While the previous fix addressed group-membership endpoints, the group-move reparenting and organization group reparenting endpoints remain vulnerable. The flaw exists because these endpoints lack a check to determine if the target parent group is mapped to administrative roles.
Exploitation requires the attacker to have a delegated administrator account with the manage-users role and manage permissions on both the source and target groups. By moving a group containing users they control under a group mapped to an administrative role such as realm-admin, the attacker causes those users to inherit the administrative role mappings.
Successful exploitation allows an attacker to gain full administrative control over the realm, enabling them to modify realm configurations, manage all users and roles, access sensitive credentials, and potentially cause a complete denial of service by deleting or resetting realm resources.