2.7

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2025-13881

CVE-2025-13881: Org.keycloak.services.resources.admin: keycloak: limited administrator can retrieve sensitive user attributes via admin api

A flaw was found in Keycloak Admin API. This vulnerability allows an administrator with limited privileges to retrieve sensitive custom attributes via the /unmanagedAttributes endpoint, bypassing User Profile visibility settings.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2025-13881

CVE-2025-13881:

2.7

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
org.keycloak:keycloak-services	maven	< 26.5.2	26.5.2

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The analysis started by examining the commits associated with the vulnerability. The primary commit referenced in the advisory was a test fix. By investigating the associated pull request, the core commit containing the security fix was identified. The patch was located in the getWritable method of the org.keycloak.userprofile.DefaultAttributes class. The original code contained a logical flaw that incorrectly identified unmanaged user attributes as writable, even when the administrative policy was set to view-only. This allowed an attacker with limited privileges to modify attributes they should not have access to. Although the vulnerability description focuses on data retrieval, the provided patch and associated pull request title clearly indicate a fix for a writing vulnerability. The test cases added in the patch confirm that with an ADMIN_VIEW policy, unmanaged attributes are still retrieved but are no longer writable. It is highly probable that the vulnerable getWritable method was also used by the attribute retrieval endpoint (/unmanagedAttributes), causing both an information disclosure and a privilege escalation vulnerability. The fix replaces the faulty logic with a call to isReadOnly(name), which correctly enforces the configured security policies.

Vulnerable functions

org.keycloak.userprofile.DefaultAttributes.getWritable

server-spi-private/src/main/java/org/keycloak/userprofile/DefaultAttributes.java

The `getWritable` method had flawed logic for determining if an attribute was writable. The condition `!isManagedAttribute(name)` caused the method to incorrectly classify unmanaged attributes as writable, even when the security policy was set to `ADMIN_VIEW`. This allowed a limited administrator to modify attributes that should have been read-only. The vulnerability description mentions retrieval of sensitive data, and it is likely that the same flawed `getWritable` method was used by the `/unmanagedAttributes` endpoint to filter attributes for display, thus leading to an information disclosure vulnerability as well.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.