CVE-2026-94000
MEDIUM 1 PoC
MEDIUM
Priority: 0.03
BB Relevance:
58/100
Published: 2026-09-19
Modified: 2026-11-06
First seen: 2026-11-06
Status: active
Attack Surface
Network
No Interaction
Conf. Impact
Integ. Impact
CVSS Vector Breakdown
AV:
Network
AC:
High
PR:
High
UI:
None
S:
Unchanged
C:
High
I:
High
A:
High
Description
A flaw was found in the Admin REST API of Keycloak, an open-source identity and access management solution. The issue occurs in the group-membership endpoints where the system fails to check if a group grants administrative privileges before allowing a user to be added. This allows a delegated administrator with limited permissions to add themselves to a high-privilege group, potentially gaining full control over the entire realm.
Weakness Classification (1)
References & Advisories (4)
vendor-advisory
x_refsource_REDHAT
vendor-advisory
x_refsource_REDHAT
vdb-entry
x_refsource_REDHAT
issue-tracking
x_refsource_REDHAT