CVE-2026-116468 | BDVDB-2026-404777 Detail

Description#

A flaw was found in the group-move and organization group reparenting endpoints of the keycloak-services component. This component is responsible for core authentication and authorization services in the Red Hat build of Keycloak. The issue occurs because the system fails to check if a target parent group confers administrative roles when a group is moved. A delegated administrator can exploit this to move a group they control under an administrative group, causing all members to inherit full realm-admin privileges and gain complete control over the realm.

Impact#

Weaknesses#

References#

Exploit#

History#

1. Version 12026-11-11Record published in the CVE List.