CVSS 3.1
7.2 highCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:HCVE-2026-3121
High (7.2) in redhat. EPSS 0.5% chance of exploitation in the next 30 days. Fixed in org.keycloak:keycloak-services 26.5.6.
A flaw was found in Keycloak. An administrator with `manage-clients` permission can exploit a misconfiguration where this permission is equivalent to `manage-permissions`. This allows the administrator to escalate privileges and gain control over roles, users, or other administrative functions within the realm. This privilege escalation can occur when admin permissions are enabled at the realm level.
Severity
- EPSS
- 0.5% chance of exploitation in the next 30 days; higher than 41% of CVEs (scores of 2026-10-31)
- CWE
- CWE-266
- Published
- Modified
- Record from
- the NVD, synced
Affected
- redhat:build_of_keycloak
- redhat:jboss_enterprise_application_platform
- redhat:jboss_enterprise_application_platform_expansion_pack
- redhat:single_sign-on
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-7xf9-4jfc-wgm4 | Maven | org.keycloak:keycloak-services | <26.5.6 | 26.5.6 |