VYPR
Get started
← All advisories
Medium severity6.5NVD Advisory· Published Mar 26, 2026· Updated Apr 2, 2026

CVE-2026-3121

CVE-2026-3121

Description

A flaw was found in Keycloak. An administrator with manage-clients permission can exploit a misconfiguration where this permission is equivalent to manage-permissions. This allows the administrator to escalate privileges and gain control over roles, users, or other administrative functions within the realm. This privilege escalation can occur when admin permissions are enabled at the realm level.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
org.keycloak:keycloak-servicesMaven
< 26.5.626.5.6

Affected products

4

Patches

1
79ab3110a257

Privilege escalation via manage-clients permission

https://github.com/keycloak/keycloakvramikMar 5, 2026via ghsa
commit
1 file changed · +11 −2
  • services/src/main/java/org/keycloak/services/resources/admin/fgap/RealmPermissionsV2.java+11 −2 modified
    @@ -16,6 +16,7 @@
  */
 package org.keycloak.services.resources.admin.fgap;
 
+import org.keycloak.authorization.fgap.AdminPermissionsSchema;
 import org.keycloak.authorization.model.ResourceServer;
 import org.keycloak.models.ClientModel;
 
@@ -27,6 +28,10 @@ public RealmPermissionsV2(MgmtPermissions root) {
 
     @Override
     public boolean canManageAuthorizationDefault(ResourceServer resourceServer) {
+        // if the ResourceServer belongs to the admin-permissions client, check manage-realm
+        if (resourceServer != null && AdminPermissionsSchema.SCHEMA.isAdminPermissionClient(root.realm, resourceServer.getId())) {
+            return super.canManageRealm();
+        }
         if (super.canManageAuthorizationDefault(resourceServer)) {
             return true;
         }
@@ -36,6 +41,10 @@ public boolean canManageAuthorizationDefault(ResourceServer resourceServer) {
 
     @Override
     public boolean canViewAuthorizationDefault(ResourceServer resourceServer) {
+        // if the ResourceServer belongs to the admin-permissions client, check manage-realm or view-realm
+        if (resourceServer != null && AdminPermissionsSchema.SCHEMA.isAdminPermissionClient(root.realm, resourceServer.getId())) {
+            return super.canViewRealm();
+        }
         if (super.canViewAuthorizationDefault(resourceServer)) {
             return true;
         }
@@ -44,7 +53,7 @@ public boolean canViewAuthorizationDefault(ResourceServer resourceServer) {
     }
 
     private ClientModel getClient(ResourceServer resourceServer) {
-        ClientModel client = root.session.clients().getClientById(root.realm, resourceServer.getId());
-        return client;
+        if (resourceServer == null) return null;
+        return root.session.clients().getClientById(root.realm, resourceServer.getId());
     }
 }

Vulnerability mechanics

Generated by null/stub on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

8

News mentions

0

No linked articles in our index yet.