Search for vulnerabilities
Vulnerability details: VCID-7nhn-26zx-4fam
Vulnerability ID VCID-7nhn-26zx-4fam
Aliases GHSA-83j7-mhw9-388w
Summary Duplicate Advisory: Keycloak Privilege Escalation Vulnerability in Admin Console (FGAPv2 Enabled) ### Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-27gp-8389-hm4w. This link is maintained to preserve external references. ### Original Description A flaw was found in the Keycloak identity and access management system when Fine-Grained Admin Permissions (FGAPv2) are enabled. An administrative user with the manage-users role can escalate their privileges to realm-admin due to improper privilege enforcement. This vulnerability allows unauthorized elevation of access rights, compromising the intended separation of administrative duties and posing a security risk to the realm.
Status Published
Exploitability 0.5
Weighted Severity 6.2
Risk 3.1
Affected and Fixed Packages Package Details
Weaknesses (3)
CWE-269 Improper Privilege Management
CWE-937 OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
CWE-1035 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
System Score Found at
cvssv3.1 6.5 https://access.redhat.com/errata/RHSA-2025:12015
generic_textual MODERATE https://access.redhat.com/errata/RHSA-2025:12015
cvssv3.1 6.5 https://access.redhat.com/errata/RHSA-2025:12016
generic_textual MODERATE https://access.redhat.com/errata/RHSA-2025:12016
cvssv3.1 6.5 https://access.redhat.com/security/cve/CVE-2025-7784
generic_textual MODERATE https://access.redhat.com/security/cve/CVE-2025-7784
cvssv3.1 6.5 https://bugzilla.redhat.com/show_bug.cgi?id=2381861
generic_textual MODERATE https://bugzilla.redhat.com/show_bug.cgi?id=2381861
cvssv3.1_qr MODERATE https://github.com/advisories/GHSA-83j7-mhw9-388w
cvssv3.1 6.5 https://github.com/keycloak/keycloak
generic_textual MODERATE https://github.com/keycloak/keycloak
cvssv3.1 6.5 https://github.com/keycloak/keycloak/issues/41137
generic_textual MODERATE https://github.com/keycloak/keycloak/issues/41137
cvssv3.1 6.5 https://github.com/keycloak/keycloak/pull/41168
generic_textual MODERATE https://github.com/keycloak/keycloak/pull/41168
cvssv3.1 6.5 https://nvd.nist.gov/vuln/detail/CVE-2025-7784
generic_textual MODERATE https://nvd.nist.gov/vuln/detail/CVE-2025-7784
Reference id Reference type URL
https://access.redhat.com/errata/RHSA-2025:12015
https://access.redhat.com/errata/RHSA-2025:12016
https://access.redhat.com/security/cve/CVE-2025-7784
https://bugzilla.redhat.com/show_bug.cgi?id=2381861
https://github.com/keycloak/keycloak
https://github.com/keycloak/keycloak/issues/41137
https://github.com/keycloak/keycloak/pull/41168
https://nvd.nist.gov/vuln/detail/CVE-2025-7784
GHSA-83j7-mhw9-388w https://github.com/advisories/GHSA-83j7-mhw9-388w
No exploits are available.
Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N Found at https://access.redhat.com/errata/RHSA-2025:12015
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N Found at https://access.redhat.com/errata/RHSA-2025:12016
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N Found at https://access.redhat.com/security/cve/CVE-2025-7784
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N Found at https://bugzilla.redhat.com/show_bug.cgi?id=2381861
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N Found at https://github.com/keycloak/keycloak
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N Found at https://github.com/keycloak/keycloak/issues/41137
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N Found at https://github.com/keycloak/keycloak/pull/41168
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N Found at https://nvd.nist.gov/vuln/detail/CVE-2025-7784
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none

No EPSS data available for this vulnerability.

Date Actor Action Source VulnerableCode Version
2025-07-31T08:38:39.713902+00:00 GithubOSV Importer Import https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/07/GHSA-83j7-mhw9-388w/GHSA-83j7-mhw9-388w.json 37.0.0