Staging Environment: Content and features may be unstable or change without notice.
Advisory details: github_osv / GHSA-27gp-8389-hm4w
Advisory ID github_osv/GHSA-27gp-8389-hm4w
Aliases CVE-2025-7784
Summary Keycloak Privilege Escalation Vulnerability in Admin Console (FGAPv2 Enabled) A Privilege Escalation vulnerability was identified in the Keycloak identity and access management solution, specifically when FGAPv2 is enabled in version 26.2.x. The flaw lies in the admin permission enforcement logic, where a user with manage-users privileges can self-assign realm-admin rights. The escalation occurs due to missing privilege boundary checks in role mapping operations via the admin REST interface. A malicious administrator with limited permissions can exploit this by editing their own user roles, gaining unauthorized full access to realm configuration and user data. This issue has been fixed in versions 26.2.6, and 26.3.0.
Status Published
Exploitability 0.5
Weighted Severity 5.9
Risk 3.0
Affected and Fixed Packages Package Details
Introduced and Fixed Package Commit Patches Package Commit Patches Details
Weaknesses (1)
CWE-269 Improper Privilege Management
System Score Found at
cvssv3.1 6.5 https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/07/GHSA-27gp-8389-hm4w/GHSA-27gp-8389-hm4w.json
generic_textual MODERATE
Reference id Reference type URL
https://bugzilla.redhat.com/show_bug.cgi?id=2381861
https://github.com/keycloak/keycloak
https://github.com/keycloak/keycloak/issues/41137
https://github.com/keycloak/keycloak/pull/41168
CVE-2025-7784 https://access.redhat.com/security/cve/CVE-2025-7784
CVE-2025-7784 https://nvd.nist.gov/vuln/detail/CVE-2025-7784
GHSA-27gp-8389-hm4w https://github.com/keycloak/keycloak/security/advisories/GHSA-27gp-8389-hm4w
RHSA-2025:12015 https://access.redhat.com/errata/RHSA-2025:12015
RHSA-2025:12016 https://access.redhat.com/errata/RHSA-2025:12016
No exploits are available.

No EPSS data available for this advisory.

Patch URL
There are no known patches.
Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N Found at https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/07/GHSA-27gp-8389-hm4w/GHSA-27gp-8389-hm4w.json
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none

Vector: SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2025-07-18T14:46:09Z/

Decision: Track

Source URL: https://github.com/cisagov/vulnrichment/blob/develop/2025/7xxx/CVE-2025-7784.json

Source Advisory: vulnrichment/CVE-2025-7784

View SSVC decision tree 
[{'Exploitation': 'none'},
 {'Automatable': 'no'},
 {'Technical Impact': 'total'},
 {'Mission Prevalence': 'minimal'},
 {'Public Well-being Impact': 'material'},
 {'Mission & Well-being': 'medium'}]