7.3

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-9795

CVE-2026-9795: Keycloak has privilege escalation via improper scope mapping enforcement

Description

A flaw was found in Keycloak's Fine-Grained Admin Permissions (FGAPv2) feature. An administrator with limited client management permissions can exploit this vulnerability to assign any realm role, including highly privileged roles, to a client's scope mapping. This bypasses intended security controls, allowing the injected role to be projected into a user's authentication token when they access the modified client. This could lead to unauthorized privilege escalation within the Keycloak realm.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-9795

CVE-2026-9795:

7.3

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

SSVC / BOD 26-04 ↗

Exploitation NoneAutomatable NoTech Impact Total

Select your environment

→SSVCScheduled60 days

Runtime reachability resolves your actual outcome.Book a demo

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
org.keycloak:keycloak-services	maven	< 26.6.4	26.6.4

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability lies in Keycloak's Fine-Grained Admin Permissions (FGAPv2) feature, where several methods responsible for managing client and realm role scope mappings failed to enforce proper authorization checks. Specifically, the functions addClientScopeMapping, deleteClientScopeMapping in ScopeMappedClientResource.java, and addRealmScopeMappings, deleteRealmScopeMappings in ScopeMappedResource.java were missing checks to verify if the calling administrator had the map-role-client-scope permission for the roles being modified. This allowed an administrator with limited permissions (e.g., only manage-clients) to add or remove any role, including highly privileged ones like realm-admin, to a client's scope. When a user authenticates against this client, the injected privileged role would be included in their access token, leading to a privilege escalation. The patch addresses this by inserting the requireMapClientScope authorization check in all the vulnerable methods, ensuring that the administrator has the explicit permission to map the target role before the operation is allowed.

Vulnerable functions

org.keycloak.services.resources.admin.ScopeMappedClientResource.addClientScopeMapping

services/src/main/java/org/keycloak/services/resources/admin/ScopeMappedClientResource.java

The function `addClientScopeMapping` was missing a permission check to verify if the administrator had the authority to map the specified role to a client scope. The patch adds the `auth.roles().requireMapClientScope(roleModel)` call to enforce this check, preventing unauthorized privilege escalation.

org.keycloak.services.resources.admin.ScopeMappedClientResource.deleteClientScopeMapping

services/src/main/java/org/keycloak/services/resources/admin/ScopeMappedClientResource.java

The function `deleteClientScopeMapping` did not properly enforce permissions when deleting role scope mappings. The patch introduces checks (`.filter(auth.roles()::canMapClientScope)` and `auth.roles().requireMapClientScope(roleModel)`) to ensure the administrator has the required permissions before allowing the deletion of a scope mapping.

org.keycloak.services.resources.admin.ScopeMappedResource.addRealmScopeMappings

services/src/main/java/org/keycloak/services/resources/admin/ScopeMappedResource.java

Similar to `addClientScopeMapping`, the `addRealmScopeMappings` function was vulnerable because it lacked a permission check. An administrator could add any realm role to a scope without having the specific permission to do so. The patch adds `auth.roles().requireMapClientScope(roleModel)` to fix this.

org.keycloak.services.resources.admin.ScopeMappedResource.deleteRealmScopeMappings

services/src/main/java/org/keycloak/services/resources/admin/ScopeMappedResource.java

The `deleteRealmScopeMappings` function was missing authorization checks, allowing a limited administrator to remove realm-level scope mappings they were not supposed to manage. The patch adds the necessary permission checks (`.filter(auth.roles()::canMapClientScope)` and `auth.roles().requireMapClientScope(roleModel)`) to prevent this.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

7.3

-

Basic Information

Basic Information

Concerned about an active attack path?

CVE-2026-9795: Keycloak has privilege escalation via improper scope mapping enforcement

Description

CVE-2026-9795:

7.3

-

Basic Information

Basic Information

Is this CVE running in your environment?

Technical Details

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

Vulnerable functions

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

WAF Protection Rules

WAF Rule

Detect and Respond To Threats Faster.

7.3

7.3

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

Vulnerable functions

CVE-2026-9795: Keycloak has privilege escalation via improper scope mapping enforcement

Description

Basic Information

Basic Information

Technical Details

7.3

-

Basic Information

Basic Information

Concerned about an active attack path?

CVE-2026-9795: Keycloak has privilege escalation via improper scope mapping enforcement

Description

CVE-2026-9795:

7.3

-

Basic Information

Basic Information

Is this CVE running in your environment?

Technical Details

Technical Details

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

Vulnerability IntelligenceMiggo AI

Unlock WAF rules for this CVE

WAF Protection Rules

WAF Rule

7.3

7.3

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

CVE-2026-9795: Keycloak has privilege escalation via improper scope mapping enforcement

Description

Basic Information

Basic Information

Technical Details

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI