2.7

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2025-14082

CVE-2025-14082: Keycloak Admin REST (Representational State Transfer) API does not properly enforce permissions

A flaw was found in Keycloak Admin REST (Representational State Transfer) API. This vulnerability allows information disclosure of sensitive role metadata via insufficient authorization checks on the /admin/realms/{realm}/roles endpoint.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2025-14082

CVE-2025-14082:

2.7

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
org.keycloak:keycloak-services	maven	<= 26.4.7

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is an improper access control issue in Keycloak's Admin REST API, specifically concerning the endpoint for managing roles. The root cause lies in the org.keycloak.authorization.jpa.store.JPAPolicyStore.findDependentPolicies method, which is responsible for fetching authorization policies. The pre-patch version of this method had a flaw where it would query for policies with either 'view' or 'view-members' scopes, without distinguishing between the type of resource being accessed. This meant that a user having 'view-members' permission on a group could inadvertently gain 'view' access to other resources, such as role metadata, which should have been restricted.

The patch addresses this by introducing a groupResourceType parameter to the findDependentPolicies method and its callers. This allows the method to differentiate the context of the permission check. If the check is related to groups, it looks for the 'view-members' scope; otherwise, it looks for the 'view' scope. This ensures that permissions are not incorrectly applied across different resource types.

The function org.keycloak.authorization.policy.provider.role.RolePolicyProvider.getPermissions is a key part of the call chain for this vulnerability. When a user accesses the roles endpoint, this provider is invoked to check permissions, which then calls the flawed findDependentPolicies method. Therefore, both of these functions would appear in a runtime profile during exploitation.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.