Keycloak: keycloak: privilege escalation via improper scope mapping enforcement

Description

A flaw was found in Keycloak's Fine-Grained Admin Permissions (FGAPv2) feature. An administrator with limited client management permissions can exploit this vulnerability to assign any realm role, including highly privileged roles, to a client's scope mapping. This bypasses intended security controls, allowing the injected role to be projected into a user's authentication token when they access the modified client. This could lead to unauthorized privilege escalation within the Keycloak realm.

Timeline

Scores

EPSS (exploitation in 30 days)

0.35% · top 70% of all CVEs (12 Nov 2026)

CISA SSVC

Exploitation: none · Automatable: no · Technical impact: total

The list uses the assigner's score when there is one, then CISA's, then NVD's: High 7.3.

Affected products

• Red Hat · Red Hat build of Keycloak 26.4

  • unaffected 26.4.13-1 – < *

• Red Hat · Red Hat build of Keycloak 26.4

  • unaffected 26.4-19 – < *

• Red Hat · Red Hat build of Keycloak 26.4

  • unaffected 26.4-19 – < *

• Red Hat · Red Hat build of Keycloak 26.4.13

  All versions: unaffected

• Red Hat · Red Hat build of Keycloak 26.6

  • unaffected 26.6.4-2 – < *

• Red Hat · Red Hat build of Keycloak 26.6

  • unaffected 26.6-8 – < *

• Red Hat · Red Hat build of Keycloak 26.6

  • unaffected 26.6-8 – < *

• Red Hat · Red Hat build of Keycloak 26.6.4

  All versions: unaffected

Affected packages

From reviewed advisories of the GitHub Advisory Database.

• Mavenorg.keycloak:keycloak-servicesGHSA-32h4-44jj-c5vx (opens in a new tab)

What to do

Workaround: To mitigate this issue, disable the Fine-Grained Admin Permissions (FGAPv2) feature in Keycloak if it is not strictly required. This can typically be done by setting `adminPermissionsEnabled` to `false` in the realm configuration. Disabling FGAPv2 will prevent the exploitation of this flaw by removing the vulnerable functionality. However, this may impact administrative delegation capabilities within Keycloak. A restart or reload of the Keycloak service may be required for the changes to take effect.

Sources

The same CVE in the primary databases and aggregators, to check against.

• CVE.org record (opens in a new tab)
• CVE List JSON (GitHub) (opens in a new tab)
• NVD (opens in a new tab)
• FIRST EPSS (opens in a new tab)
• EUVD EUVD-2026-32710 (opens in a new tab)
• OSV.dev (opens in a new tab)
• GitHub Advisory GHSA-32h4-44jj-c5vx (opens in a new tab)
• CIRCL Vulnerability-Lookup (opens in a new tab)

Badge for a README or a ticket

[![CVE-2026-9795](https://cveledger.app/badge/CVE-2026-9795.svg)](https://cveledger.app/cve/CVE-2026-9795)

Record last updated 15 Jul 2026, 00:38 UTC.