Search for vulnerabilities
Vulnerability details: VCID-6hu8-4ryn-kudz
Vulnerability ID VCID-6hu8-4ryn-kudz
Aliases CVE-2025-7784
GHSA-27gp-8389-hm4w
Summary Keycloak Privilege Escalation Vulnerability in Admin Console (FGAPv2 Enabled) A Privilege Escalation vulnerability was identified in the Keycloak identity and access management solution, specifically when FGAPv2 is enabled in version 26.2.x. The flaw lies in the admin permission enforcement logic, where a user with manage-users privileges can self-assign realm-admin rights. The escalation occurs due to missing privilege boundary checks in role mapping operations via the admin REST interface. A malicious administrator with limited permissions can exploit this by editing their own user roles, gaining unauthorized full access to realm configuration and user data. This issue has been fixed in versions 26.2.6, and 26.3.0.
Status Published
Exploitability 0.5
Weighted Severity 6.2
Risk 3.1
Affected and Fixed Packages Package Details
Weaknesses (3)
CWE-269 Improper Privilege Management
CWE-937 OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
CWE-1035 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
System Score Found at
cvssv3.1 6.5 https://access.redhat.com/errata/RHSA-2025:12015
generic_textual MODERATE https://access.redhat.com/errata/RHSA-2025:12015
cvssv3.1 6.5 https://access.redhat.com/errata/RHSA-2025:12016
generic_textual MODERATE https://access.redhat.com/errata/RHSA-2025:12016
cvssv3 6.5 https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2025-7784.json
cvssv3.1 6.5 https://access.redhat.com/security/cve/CVE-2025-7784
generic_textual MODERATE https://access.redhat.com/security/cve/CVE-2025-7784
ssvc Track https://access.redhat.com/security/cve/CVE-2025-7784
epss 0.0001 https://api.first.org/data/v1/epss?cve=CVE-2025-7784
epss 0.0001 https://api.first.org/data/v1/epss?cve=CVE-2025-7784
epss 0.00011 https://api.first.org/data/v1/epss?cve=CVE-2025-7784
epss 0.00011 https://api.first.org/data/v1/epss?cve=CVE-2025-7784
epss 0.00011 https://api.first.org/data/v1/epss?cve=CVE-2025-7784
epss 0.00011 https://api.first.org/data/v1/epss?cve=CVE-2025-7784
epss 0.00011 https://api.first.org/data/v1/epss?cve=CVE-2025-7784
epss 0.00011 https://api.first.org/data/v1/epss?cve=CVE-2025-7784
epss 0.00011 https://api.first.org/data/v1/epss?cve=CVE-2025-7784
epss 0.00011 https://api.first.org/data/v1/epss?cve=CVE-2025-7784
epss 0.00012 https://api.first.org/data/v1/epss?cve=CVE-2025-7784
epss 0.00026 https://api.first.org/data/v1/epss?cve=CVE-2025-7784
epss 0.00026 https://api.first.org/data/v1/epss?cve=CVE-2025-7784
epss 0.00026 https://api.first.org/data/v1/epss?cve=CVE-2025-7784
epss 0.00026 https://api.first.org/data/v1/epss?cve=CVE-2025-7784
epss 0.00026 https://api.first.org/data/v1/epss?cve=CVE-2025-7784
epss 0.00026 https://api.first.org/data/v1/epss?cve=CVE-2025-7784
epss 0.00026 https://api.first.org/data/v1/epss?cve=CVE-2025-7784
epss 0.00026 https://api.first.org/data/v1/epss?cve=CVE-2025-7784
epss 0.00026 https://api.first.org/data/v1/epss?cve=CVE-2025-7784
epss 0.00026 https://api.first.org/data/v1/epss?cve=CVE-2025-7784
epss 0.00026 https://api.first.org/data/v1/epss?cve=CVE-2025-7784
epss 0.00026 https://api.first.org/data/v1/epss?cve=CVE-2025-7784
epss 0.00026 https://api.first.org/data/v1/epss?cve=CVE-2025-7784
epss 0.00029 https://api.first.org/data/v1/epss?cve=CVE-2025-7784
epss 0.00029 https://api.first.org/data/v1/epss?cve=CVE-2025-7784
epss 0.00029 https://api.first.org/data/v1/epss?cve=CVE-2025-7784
epss 0.00029 https://api.first.org/data/v1/epss?cve=CVE-2025-7784
cvssv3.1 6.5 https://bugzilla.redhat.com/show_bug.cgi?id=2381861
generic_textual MODERATE https://bugzilla.redhat.com/show_bug.cgi?id=2381861
ssvc Track https://bugzilla.redhat.com/show_bug.cgi?id=2381861
cvssv3.1_qr MODERATE https://github.com/advisories/GHSA-27gp-8389-hm4w
cvssv3.1 6.5 https://github.com/keycloak/keycloak
generic_textual MODERATE https://github.com/keycloak/keycloak
cvssv3.1 6.5 https://github.com/keycloak/keycloak/issues/41137
generic_textual MODERATE https://github.com/keycloak/keycloak/issues/41137
cvssv3.1 6.5 https://github.com/keycloak/keycloak/pull/41168
generic_textual MODERATE https://github.com/keycloak/keycloak/pull/41168
cvssv3.1 6.5 https://github.com/keycloak/keycloak/security/advisories/GHSA-27gp-8389-hm4w
cvssv3.1_qr MODERATE https://github.com/keycloak/keycloak/security/advisories/GHSA-27gp-8389-hm4w
generic_textual MODERATE https://github.com/keycloak/keycloak/security/advisories/GHSA-27gp-8389-hm4w
cvssv3.1 6.5 https://nvd.nist.gov/vuln/detail/CVE-2025-7784
generic_textual MODERATE https://nvd.nist.gov/vuln/detail/CVE-2025-7784
Reference id Reference type URL
https://access.redhat.com/errata/RHSA-2025:12015
https://access.redhat.com/errata/RHSA-2025:12016
https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2025-7784.json
https://access.redhat.com/security/cve/CVE-2025-7784
https://api.first.org/data/v1/epss?cve=CVE-2025-7784
https://bugzilla.redhat.com/show_bug.cgi?id=2381861
https://github.com/keycloak/keycloak
https://github.com/keycloak/keycloak/issues/41137
https://github.com/keycloak/keycloak/pull/41168
https://github.com/keycloak/keycloak/security/advisories/GHSA-27gp-8389-hm4w
https://nvd.nist.gov/vuln/detail/CVE-2025-7784
cpe:2.3:a:redhat:build_of_keycloak:-:*:*:*:-:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:redhat:build_of_keycloak:-:*:*:*:-:*:*:*
cpe:/a:redhat:build_keycloak: https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:/a:redhat:build_keycloak:
cpe:/a:redhat:jbosseapxp https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:/a:redhat:jbosseapxp
cpe:/a:redhat:jboss_enterprise_application_platform:8 https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:/a:redhat:jboss_enterprise_application_platform:8
cpe:/a:redhat:red_hat_single_sign_on:7 https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:/a:redhat:red_hat_single_sign_on:7
GHSA-27gp-8389-hm4w https://github.com/advisories/GHSA-27gp-8389-hm4w
No exploits are available.
Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N Found at https://access.redhat.com/errata/RHSA-2025:12015
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N Found at https://access.redhat.com/errata/RHSA-2025:12016
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N Found at https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2025-7784.json
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N Found at https://access.redhat.com/security/cve/CVE-2025-7784
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2025-07-18T14:46:09Z/ Found at https://access.redhat.com/security/cve/CVE-2025-7784
Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N Found at https://bugzilla.redhat.com/show_bug.cgi?id=2381861
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2025-07-18T14:46:09Z/ Found at https://bugzilla.redhat.com/show_bug.cgi?id=2381861
Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N Found at https://github.com/keycloak/keycloak
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N Found at https://github.com/keycloak/keycloak/issues/41137
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N Found at https://github.com/keycloak/keycloak/pull/41168
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N Found at https://github.com/keycloak/keycloak/security/advisories/GHSA-27gp-8389-hm4w
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N Found at https://nvd.nist.gov/vuln/detail/CVE-2025-7784
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Exploit Prediction Scoring System (EPSS)
Percentile 0.00799
EPSS Score 0.0001
Published At Aug. 16, 2025, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2025-07-31T08:38:52.008081+00:00 GithubOSV Importer Import https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/07/GHSA-27gp-8389-hm4w/GHSA-27gp-8389-hm4w.json 37.0.0