{"id":"CVE-2026-116468","aliases":["EUVD-2026-123317","GHSA-pp48-27fj-q9cx"],"status":"published","title":"Keycloak-services: keycloak-services: delegated admin escalates to realm-admin via group move","description":"A flaw was found in the group-move and organization group reparenting endpoints of the keycloak-services component. This component is responsible for core authentication and authorization services in the Red Hat build of Keycloak. The issue occurs because the system fails to check if a target parent group confers administrative roles when a group is moved. A delegated administrator can exploit this to move a group they control under an administrative group, causing all members to inherit full realm-admin privileges and gain complete control over the realm.","severity":{"version":"3.1","score":6.6,"vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.00457,"percentile":0.40097,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-862"],"published":"2026-11-11T07:57:21Z","modified":"2026-11-11T09:31:29Z","products":[{"vendor":"red hat","product":"red hat build of keycloak"},{"vendor":"red hat","product":"red hat single sign-on 7"}],"references":[{"url":"https://access.redhat.com/security/cve/CVE-2026-116468","tags":["vdb-entry","x_refsource_REDHAT"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2560575","tags":["issue-tracking","x_refsource_REDHAT"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116468"},{"url":"https://github.com/advisories/GHSA-pp48-27fj-q9cx"}],"sources":{"cve":[{"id":"CVE-2026-116468","title":"Keycloak-services: keycloak-services: delegated admin escalates to realm-admin via group move","description":"A flaw was found in the group-move and organization group reparenting endpoints of the keycloak-services component. This component is responsible for core authentication and authorization services in the Red Hat build of Keycloak. The issue occurs because the system fails to check if a target parent group confers administrative roles when a group is moved. A delegated administrator can exploit this to move a group they control under an administrative group, causing all members to inherit full realm-admin privileges and gain complete control over the realm.","status":"published","published":"2026-11-11T07:57:21.958Z","modified":"2026-11-11T07:57:21.958Z","cvss":[{"version":"3.1","score":6.6,"vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"medium","assessor":"cna"}],"cwes":["CWE-862"],"updated_at":"2026-11-11T08:55:26.475031Z"}],"euvd":[{"id":"EUVD-2026-123317","description":"A flaw was found in the group-move and organization group reparenting endpoints of the keycloak-services component. This component is responsible for core authentication and authorization services in the Red Hat build of Keycloak. The issue occurs because the system fails to check if a target parent group confers administrative roles when a group is moved. A delegated administrator can exploit this to move a group they control under an administrative group, causing all members to inherit full realm-admin privileges and gain complete control over the realm.","status":"published","published":"2026-11-11T07:57:21Z","modified":"2026-11-11T07:57:21Z","cvss":[{"version":"3.1","score":6.6,"vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"medium"}],"updated_at":"2026-11-11T11:28:20.213197Z"}],"ghsa":[{"id":"GHSA-pp48-27fj-q9cx","title":"A flaw was found in the group-move and organization group reparenting endpoints of the keycloak...","description":"A flaw was found in the group-move and organization group reparenting endpoints of the keycloak-services component. This component is responsible for core authentication and authorization services in the Red Hat build of Keycloak. The issue occurs because the system fails to check if a target parent group confers administrative roles when a group is moved. A delegated administrator can exploit this to move a group they control under an administrative group, causing all members to inherit full realm-admin privileges and gain complete control over the realm.","status":"published","published":"2026-11-11T09:31:28Z","modified":"2026-11-11T09:31:29Z","cvss":[{"version":"3.1","score":6.6,"vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"medium"}],"cwes":["CWE-862"],"updated_at":"2026-11-11T09:33:11.21985Z"}],"nvd":[{"id":"CVE-2026-116468","description":"A flaw was found in the group-move and organization group reparenting endpoints of the keycloak-services component. This component is responsible for core authentication and authorization services in the Red Hat build of Keycloak. The issue occurs because the system fails to check if a target parent group confers administrative roles when a group is moved. A delegated administrator can exploit this to move a group they control under an administrative group, causing all members to inherit full realm-admin privileges and gain complete control over the realm.","status":"published","published":"2026-11-11T08:17:17.077Z","modified":"2026-11-11T08:17:17.217Z","cvss":[{"version":"3.1","score":6.6,"vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"medium","assessor":"primary"}],"cwes":["CWE-862"],"updated_at":"2026-11-11T12:24:45.117793Z"}]}}